https://github.com/osquery/osquery logo
Title
a

Anoop K V

05/24/2021, 4:44 PM
When carving, I am getting the message, "I0524 17:33:32.621054 10575 carver.cpp:186] Failed to post carve: No session_id received from remote endpoint" Any idea what is happening and how to avert?
n

nyanshak

05/24/2021, 4:54 PM
what tls server are you using?
a

Anoop K V

05/24/2021, 6:15 PM
Thanks for the reply, you meant config_tls_endpoint? Then /api/v1/osquery/config. BTW, I do not observe this error regularly, it starts the moment I configure an S3 bucket in fleet to collect the carved files.
n

nyanshak

05/24/2021, 6:15 PM
ah okay, very helpful info
probably better off asking in #fleet
a

Anoop K V

05/24/2021, 6:16 PM
Sure, thanks