https://github.com/osquery/osquery logo
#fleet
Title
# fleet
m

Manish

06/14/2022, 4:05 PM
Hi, Whats the clean way to uninstall and reinstall fleet agent on windows? step 1. Go to programs and uninstall 'fleet osquery' . step 2. Install by double clicking on the msi installer -- is this correct way? the problem I am facing is in step 2, somehow it hangs for a minute and then gives "Fatal error" in installation without any further detail. For now I am shooting in the dark due to lack of descriptive error message. Any idea?
z

zwass

06/14/2022, 4:21 PM
Can you open up "Services" and see if "Fleet osquery" is running in there?
m

Manish

06/14/2022, 4:22 PM
It wasn't running. It's not in the listed services.
Weird thing is it's not happening to all the machines, only some of them.. and windows is so un-descriptive its difficult to say whats happening.. only hint is it takes about a minute before throwing the above error.
z

zwass

06/14/2022, 5:00 PM
Which version of
fleetctl
did you use to build the package?
m

Manish

06/14/2022, 5:37 PM
For sure it's <= 4.8.0 . I can get the exact version tomorrow but it will be <= 4.8.0
mostly 4.8.0
confirmed, its 4.8.0
l

Lucas Rodriguez

06/15/2022, 11:49 AM
It could be related to this issue: https://github.com/fleetdm/fleet/issues/3563 You could try the following: 1. Uninstall Fleet. 2. Manually remove
C:\Program Files\Orbit
folder 3. Install Fleet.
m

Manish

06/15/2022, 12:13 PM
I think I found the issue, the service not connecting in the default timeout that windows has which is 30 seconds. I increased it to 10 minutes in the registry and restarted the machine (just restarting without the editing the timeout didnt work even after deleting the Orbit folder manually). Now the Fleet Osquery service was running after the restart of the machine automatically. Weird that it takes more than 30 secs for the service to connect (if my conclusion is correct)
The timeout event
l

Lucas Rodriguez

06/15/2022, 12:17 PM
You could take a look at Orbit+osquery logs in
C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log
m

Manish

06/15/2022, 12:18 PM
Ok, will check it out
Somehow there is no folder FleetDM as such in the Local directory
19 Views