Ojas
04/25/2022, 10:34 AMLucas Rodriguez
04/25/2022, 11:54 AMping <http://tuf.fleetctl.com|tuf.fleetctl.com>
and maybe curl <https://tuf.fleetctl.com>
)C:\Program Files\Orbit\bin\orbit.exe --version
Ojas
04/25/2022, 11:57 AMLucas Rodriguez
04/25/2022, 11:58 AMlookup <http://tuf.fleetctl.com|tuf.fleetctl.com>: no such host
logs.Ojas
04/25/2022, 11:59 AMLucas Rodriguez
04/25/2022, 12:53 PM<http://tuf.fleetctl.com|tuf.fleetctl.com>
?Ojas
04/25/2022, 12:54 PMLucas Rodriguez
04/25/2022, 12:55 PMOjas
04/25/2022, 1:02 PMLucas Rodriguez
04/25/2022, 1:03 PMcmd
and see if it provides more logs/information there.fleet-osquery
and select Properties
. And you will be able to copy/paste the command+arguments used to start Orbit.Ojas
04/25/2022, 1:12 PMLucas Rodriguez
04/25/2022, 1:13 PMError reading config: Cannot parse JSON: The document root must not be followed by other values. Offset: 4
Did you change the agents options in Fleet recently?Ojas
04/25/2022, 1:14 PMLucas Rodriguez
04/25/2022, 1:16 PMagent options
or the fleet config
?
By agent options I mean "Global agent options" from the settings:Ojas
04/25/2022, 1:17 PMLucas Rodriguez
04/25/2022, 1:17 PMfilesystem:
enable_log_rotation: true
is not valid, as it's a fleet config, not an osquery config.Ojas
04/25/2022, 1:18 PMLucas Rodriguez
04/25/2022, 1:18 PMfilesystem.enable_log_rotation
that configures log rotation for fleet logs, not osquery logs.fleetctl
, it doesn't affect agents, it affects fleet log files.Ojas
04/25/2022, 1:20 PMLucas Rodriguez
04/25/2022, 2:05 PMcmd
as before do you still get the same error?logger_plugin
) for Global agent settings
configuration that comes with fleet?
config:
options:
logger_plugin: tls
pack_delimiter: /
logger_tls_period: 10
distributed_plugin: tls
disable_distributed: false
logger_tls_endpoint: /api/osquery/log
distributed_interval: 10
distributed_tls_max_attempts: 3
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
overrides: {}
Ojas
04/25/2022, 7:03 PMLucas Rodriguez
04/25/2022, 7:16 PMconfig:
options:
logger_plugin: filesystem
Ojas
04/25/2022, 7:16 PMLucas Rodriguez
04/25/2022, 7:17 PMError reading config: Cannot parse JSON: The document root must not be followed by other values. Offset: 4
when running Orbit manually in cmd
?Ojas
04/25/2022, 7:17 PMLucas Rodriguez
04/25/2022, 8:38 PM--disable-updates
option (can be set in Orbit manually or you can define it when generating the packages (MSI, PKG, DEB, RPM) with fleetctl package
).Dawei Zhang
04/26/2022, 2:54 AMOjas
04/26/2022, 6:06 AMLucas Rodriguez
04/26/2022, 11:25 AMOjas
04/26/2022, 12:02 PM