The moment I try to redirect carves to S3 bucket, ...
# fleeta
Anoop K V
05/24/2021, 6:17 PMThe moment I try to redirect carves to S3 bucket, I am getting the message in Osquery, "I0524 173332.621054 10575 carver.cpp:186] Failed to post carve: No session_id received from remote endpoint" and fails. Any idea what is happening and how to avert?
n
Noah Talerman
05/24/2021, 7:04 PMHi @Anoop K V. You’re able to successfully initiate a carve when you don’t try to redirect to S3, correct?
a
Anoop K V
05/24/2021, 10:37 PMYes, that is correct
Anoop K V
05/24/2021, 10:39 PMNo errors seen without S3 params
z
zwass
05/25/2021, 1:18 AM
S3 was a community contribution so we are not super familiar with it. I do notice that SessionId comes from the upload ID (https://github.com/fleetdm/fleet/blob/master/server/datastore/s3/carves.go#L42). The Go SDK docs (https://docs.aws.amazon.com/sdk-for-go/api/service/s3/#CreateMultipartUploadOutput) don't indicate when this might be empty, but I suppose we need a check for that?
zwass
05/25/2021, 1:20 AM
These docs (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html) don't specify either. If you are able to do some debugging on your own that would be helpful.
zwass
05/25/2021, 1:24 AM
Turning on
--verbose --tls_dumpa
Anoop K V
05/25/2021, 6:06 AMThanks @zwass I will explore these links. Unfortunately the verbose logs did not give much insight here.
z
zwass
05/25/2021, 4:08 PM
Did the
--tls_dump✅ 1
a
Anoop K V
05/27/2021, 4:53 AMThanks, that went unnoticed as it turned up bit later printing the "No session_id received from remote endpoint" message. It was because of my trust permissions given to the AssumeRole. Rectified the same. Now I am getting the files in S3. Thanks again.
🍻 1