Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
b
benbass
09/13/2021, 4:36 PMI am getting an authentication error when trying to download a carve from fleet 4.2.4.
download carve received status 401: Authentication required: Authentication requiredz
zwass
09/13/2021, 5:52 PMNot sure if I'm interpreting correctly -- You've tried with matching Fleet server and
fleetctlb
benbass
09/13/2021, 5:53 PMYes, my last try was with matching 4.2.4 versions.
I can get the carve status, but not the actual files.
z
zwass
09/13/2021, 5:58 PMCan you try adding
--debugfleetctlb
benbass
09/13/2021, 6:37 PM% fleetctl get carve --outfile file.tar 1 --context test-outer 14:35:32
download carve received status 401: Authentication required: Authentication required
% fleetctl get carve --outfile file.tar 1 --context test-outer --debug 14:35:37
download carve received status 401: Authentication required: Authentication required
However when i run the get carves with debug I get info:
fleetctl get carves --context test-outer --debug 14:36:46
GET <https://fleetdm-test.fqdn:8080/api/v1/fleet/carves>
GET <https://fleetdm-test.fqdn:8080/api/v1/fleet/carves> 200 OK (106ms)
{
"carves": [
{
"id": 1,
"created_at": "2021-09-13T16:04:49Z",
"host_id": 1,
"name": "hostname-2021-09-13T16:04:49Z-51224d0a-3065-45ea-a3dc-29fc8670c93c",
"block_count": 1,
"block_size": 2000000,
"carve_size": 37888,
"carve_id": "e7e5d654-c7da-400a-8866-1f52b5fa61f0",
"request_id": "51224d0a-3065-45ea-a3dc-29fc8670c93c",
"session_id": "499ac948-6a28-423a-92ee-c9f338f17bfb",
"expired": false,
"max_block": 0
}
]
}
+----+-------------------------------+--------------------------------------+------------+------------+
| ID | CREATED AT | REQUEST ID | CARVE SIZE | COMPLETION |
+----+-------------------------------+--------------------------------------+------------+------------+
| 1 | 2021-09-13 12:04:49 -0400 EDT | 51224d0a-3065-45ea-a3dc-29fc8670c93c | 37888 | 100% |
+----+-------------------------------+--------------------------------------+------------+------------+I cleaned up hostnames but that was it.