i keep getting this log in my osquery-status-archive file: {“hostIdentifier”:“******,“calendarTime”:“Tue Oct 4 20:53:05 2022 UTC”,“unixTime”:“1664916785",“severity”:“1",“filename”:“options.cpp”,“line”:“106",“message”:“The CLI only flag --carver_continue_endpoint set via config file will be ignored, please use a flagfile or pass it to the process at startup”,“version”:“5.5.1",“decorations”:{“host_uuid”:“*--51C8--*“,”hostname”:“ti*****.local”}} how do i fix it or stop it from writing?

How are you setting the

--carver_continue_endpoint

flag? That flag is meant to be set in the flagfile for connecting osquery agents to Fleet.

it is by default to carver_continue_endpoint: /api/v1/osquery/carve/block

🤔 - unless I'm missing something the issue seems to be that the

--carver_continue_endpoint

setting is being set in the wrong place https://fleetdm.com/docs/using-fleet/fleetctl-cli#configuration

i still dont get it what the path should be in it.

Sorry about that, it should be set to

/api/v1/osquery/carve/block

but via the flagfile

but i am not having any flag file, i create agents by fleetctl and then deploy them to hosts directly. All i can configure is global agent options

Ah gotcha, sorry about the mix-up

@Juan Fernandez so how can i fix it ? like any config in global agent which will fix it?

Do you mind posting your 'global' agent options? (By going to

Settings

->

Agent options

?

@Juan Fernandez this is the config: config: options: aws_region: ** logger_plugin: firehose logger_stderr: false disable_carver: false pack_delimiter: / aws_access_key_id: * carver_block_size: 2097152 logger_min_status: 2 logger_min_stderr: 2 logger_tls_period: 10 aws_kinesis_stream: * distributed_plugin: tls aws_firehose_stream: * disable_distributed: false distributed_interval: 10 aws_secret_access_key: * carver_start_endpoint: /api/v1/osquery/carve/begin carver_disable_function: false carver_continue_endpoint: /api/v1/osquery/carve/block osquery_status_log_plugin: firehose distributed_tls_max_attempts: 3 firehose: region: * result_stream: * status_stream: * aws_access_key_id: ****** aws_firehose_stream: * aws_secret_access_key: ******** decorators: load: - SELECT uuid AS host_uuid FROM system_info; - SELECT hostname AS hostname FROM system_info; overrides: {}

Thanks @Ojas - so there's your problem both the

--carver_start_endpoint

and

--carver_continue_endpoint

flags are meant to be set via either the flagfile or as inline options when launching osquery - you will need to remove those two options from your global config. By default, the installer generated via the 'Add New Host' dialog include the following options (see here for more details):

--disable_carver=false
--carver_disable_function=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2097152

So if you just remove those two options you should be all set.

cool thanks 🙂