proxx
04/07/2021, 10:46 PMNoah Talerman
04/07/2021, 11:25 PM--verbose --tls_dump
.
Do you mind running osqueryd with these flags and pasting the output in this thread?proxx
04/09/2021, 1:38 PMI0409 14:35:13.475466 3271 tls.cpp:255] TLS/HTTPS POST request to URI: <https://192.168.1.114:8080/api/v1/osquery/distributed/read>
{"node_key":"Sfb2QZXTeZw8503KkviGMOXF1tVXRBtv"}
{
"error": "retrieve live queries: scan active queries: scan keys: dial tcp 192.168.1.114:6379: connect: connection refused"
}
Noah Talerman
04/09/2021, 6:22 PMproxx
04/10/2021, 8:54 AMNoah Talerman
04/12/2021, 6:38 PMflagfile.txt
, what were you using to manage flags for osqueryd? Did you include the flags in the osqueryd launch command as documented here? https://github.com/fleetdm/fleet/blob/master/docs/2-Deployment/3-Adding-hosts.md#launching-osquerydproxx
04/12/2021, 9:18 PMfleet.service - Fleet Osquery Fleet Manager
Loaded: loaded (/etc/systemd/system/fleet.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Mon 2021-04-12 22:14:02 WAT; 10s ago
Process: 1527 ExecStart=/usr/local/bin/fleet serve -c /etc/fleet/fleet.yml (code=exited, status=0/SUCCESS)
Process: 1536 ExecStop=/bin/kill -15 $(ps aux | grep fleet serve | grep -v grep | awk {print$2}) (code=exited, status=1/FAILURE)
Main PID: 1527 (code=exited, status=0/SUCCESS)
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: <pid> [...] send signal to every <pid> listed
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: -<signal>, -s, --signal <signal>
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: specify the <signal> to be sent
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: -l, --list=[<signal>] list all signal names, or convert one to a name
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: -L, --table list all signal names in a nice table
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: -h, --help display this help and exit
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: -V, --version output version information and exit
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 kill[1536]: For more details see kill(1).
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 systemd[1]: fleet.service: Control process exited, code=exited, status=1/FAILURE
Apr 12 22:14:02 osquery-Standard-PC-i440FX-PIIX-1996 systemd[1]: fleet.service: Failed with result 'exit-code'.
Noah Talerman
04/12/2021, 10:07 PMWhich made me curious that i have other application residing on the same server and it did startup at rebootWhat exactly started up at reboot? Fleet or your other applications?
proxx
04/13/2021, 12:01 AMNoah Talerman
04/13/2021, 3:55 PMproxx
04/13/2021, 8:58 PMNoah Talerman
04/13/2021, 9:22 PMproxx
04/13/2021, 9:46 PMNoah Talerman
04/14/2021, 4:04 PMproxx
04/15/2021, 12:47 PMNoah Talerman
04/15/2021, 5:10 PM