Title
#fleet
s

Steven

06/06/2021, 2:46 AM
I0606 02:24:20.047855 26321 init.cpp:342] osquery initialized [version=4.8.0]
I0606 02:24:20.060935 26321 system.cpp:342] Found stale process for osqueryd (25571)
I0606 02:24:20.060984 26321 system.cpp:374] Writing osqueryd pid (26321) to /var/run/osqueryd.pidfile
I0606 02:24:20.061036 26321 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load
I0606 02:24:20.061105 26321 dispatcher.cpp:78] Adding new service: WatcherRunner (0x55736de65328) to thread: 139660570441472 (0x55736de5f8d0) in process 26321
I0606 02:24:20.061705 26322 watcher.cpp:593] osqueryd watcher (26321) executing worker (26323)
I0606 02:24:20.071314 26323 init.cpp:339] osquery worker initialized [watcher=26321]
I0606 02:24:20.071440 26323 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (0x55bf5f62cff8) to thread: 140624141027072 (0x55bf5f62b920) in process 26323
I0606 02:24:20.071499 26323 rocksdb.cpp:132] Opening RocksDB handle: /var/osquery/osquery.db
I0606 02:24:20.130610 26323 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0x55bf5f6c16c8) to thread: 140623428429568 (0x55bf5f644d30) in process 26323
I0606 02:24:20.130664 26323 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0x55bf5f6bcf48) to thread: 140623436822272 (0x55bf5f644d10) in process 26323
I0606 02:24:20.130707 26323 tls_enroll.cpp:70] TLSEnrollPlugin requesting a node enroll key from: <https://url/api/v1/osquery/enroll>
I0606 02:24:20.130699 26422 interface.cpp:270] Extension manager service starting: /var/osquery/osquery.em
I0606 02:24:20.130883 26323 smbios_tables.cpp:105] Reading SMBIOS from sysfs DMI node
I0606 02:24:20.132273 26323 smbios_tables.cpp:105] Reading SMBIOS from sysfs DMI node
I0606 02:24:20.132441 26323 tls.cpp:255] TLS/HTTPS POST request to URI: <https://url/api/v1/osquery/enroll>
{"enroll_secret":"secret","host_identifier":"ip-10-40-230-156","platform_type":"9","host_details":{"os_version":{"_id":"18.04","arch":"x86_64","codename":"bionic","major":"18","minor":"04","name":"Ubuntu","patch":"0","pid_with_namespace":"0","platform":"ubuntu","platform_like":"debian","version":"18.04.5 LTS (Bionic Beaver)"},"osquery_info":{"build_distro":"centos7","build_platform":"1","config_hash":"","config_valid":"0","extensions":"inactive","instance_id":"4b40b9d1-6d7a-45fa-ac77-b0571a26f982","pid":"26323","platform_mask":"9","start_time":"1622946260","uuid":"ec25b55a-141e-3530-3124-1322c112a3d1","version":"4.8.0","watcher":"26321"},"platform_info":{"address":"0xf000","date":"10/16/2017","extra":"","revision":"1.0","size":"65536","vendor":"Amazon EC2","version":"1.0","volume_size":"0"},"system_info":{"board_model":"","board_serial":"","board_vendor":"Amazon EC2","board_version":"","computer_name":"ip-10-40-230-156","cpu_brand":"Intel(R) Xeon(R) Platinum 8275CL CPU @ 3.00GHz\u0000\u0000","cpu_logical_cores":"8","cpu_microcode":"0x5003005","cpu_physical_cores":"4","cpu_subtype":"85","cpu_type":"x86_64","hardware_model":"c5.2xlarge","hardware_serial":"ec25b55a-141e-3530-3124-1322c112a3d1","hardware_vendor":"Amazon EC2","hardware_version":"","hostname":"ip-10-40-230-156.ec2.internal","local_hostname":"ip-10-40-230-156.ec2.internal","physical_memory":"16304521216","uuid":"ec25b55a-141e-3530-3124-1322c112a3d1"}}}

W0606 02:24:20.158818 26323 tls_enroll.cpp:77] Failed enrollment request to <https://url/api/v1/osquery/enroll> (No node key returned from TLS enroll plugin) retrying...
I see no errors with the certificates and double checked that the secret being sent is what is being displayed in the fleet gui.
zwass

zwass

06/06/2021, 4:44 PM
Is it the correct enroll secret? If you run osquery a bit longer do you see the repsonse it got from the server?