Dan Achin
03/29/2021, 5:17 PMNoah Talerman
03/29/2021, 5:38 PM--logger_tls_endpoint
as /api/v1/log
in your latest comment. Not /api/v1/osquery/log
. Is this correct?Dan Achin
03/29/2021, 5:59 PM--config_tls_max_attempts=3
and max attempts for distributed
--distributed_tls_max_attempts=3
But I don't see anything that seems to control how long clients will retry to send to Fleet. If that doesn't exist, then it supports our theory that our clients are retrying over and over and overNoah Talerman
03/29/2021, 7:20 PMdo you know if osquery will continue to try to send logs to Fleet forever if it’s not getting a 200 response?I don’t have an immediate answer to this question. Working on getting an answer now.
Dan Achin
03/29/2021, 7:31 PMNoah Talerman
03/29/2021, 7:35 PM--logger_tls_period
option to determine the number of seconds before checking for buffered logs on the client. So, the osquery client will attempt to send logs again and again to Fleet at the frequency of this intervalDan Achin
03/29/2021, 7:36 PMNoah Talerman
03/29/2021, 7:42 PMit will always keep tryingCorrect
Dan Achin
03/29/2021, 8:48 PM2021-03-29T18:42:11.682014+00:00 servername REDACTED fleet[11900]: {"component":"http","err":"decoding JSON: unexpected EOF","ts":"2021-03-29T18:42:11.68104674Z"}
I'm also seeing a lot of issues with invalid node keys, missing node keys, and logs where we have clients 'enrolling too often'Noah Talerman
03/29/2021, 10:45 PMwe are looking at everything we possibly can to try and figure out why we have clients sending GB of data every hour but hardly any of it makes it to FleetGot it. Thank you for providing your updated findings. The configurable host identifier included in 3.9.0 may be helpful for duplicate enrollment. Attempting to get a better answer for why you’re seeing the EOF errors
Dan Achin
03/29/2021, 11:22 PMseph
03/29/2021, 11:26 PMdecoding JSON: unexpected EOF
sounds like nginx is truncatingDan Achin
03/29/2021, 11:37 PMzwass
03/30/2021, 9:25 PM