Title
#fleet
j

jsanchez

03/26/2021, 5:12 PM
Hi Everyone! I am running into an issue where fleet is not sending any logs to
/var/log/osquery
for bot result.log and status.log. I was using the old environment variables from Kolide, but I recently changed them to match what is shown in the Fleetdm 3.9 doc's since I recently upgraded to that version.
Noah Talerman

Noah Talerman

03/26/2021, 5:41 PM
Hi @jsanchez! Do you mind posting the env variables you’re using to configure logging in this thread?
j

jsanchez

03/26/2021, 5:42 PM
FLEET_LOGGING_JSON: "true"
      FLEET_FILESYSTEM_ENABLE_LOG_ROTATION: "true"
      FLEET_FILESYSTEM_STATUS_LOG_FILE: /var/log/osquery/status.log
      FLEET_FILESYSTEM_RESULT_LOG_FILE: /var/log/osquery/result.log
      FLEET_OSQUERY_STATUS_LOG_PLUGIN: filesystem
      FLEET_OSQUERY_RESULT_LOG_PLUGIN: filesystem
5:43 PM
Those are the environment variable I have enabled
zwass

zwass

03/26/2021, 6:25 PM
Can you have a look at the troubleshooting steps in https://github.com/fleetdm/fleet/blob/master/docs/1-Using-Fleet/FAQ.md#troubleshooting and let us know what you find?
j

jsanchez

03/26/2021, 6:51 PM
I have gone over the troubleshooting steps. there is no
/tmp/osquery_result
I have checked the configuration by using
fleet config_dump
everything is configured correctly, I have made a query pack that runs every 1hr checking for my user name which does provide results and I have chosen snapshot for type of logging in the query pack. the log path still is empty at this point.
zwass

zwass

03/26/2021, 7:07 PM
Did you check
osquery_schedule
?
j

jsanchez

03/26/2021, 8:42 PM
Yes the query pack I have setup has had 36 executions
9:25 PM
I was able to figure it out, issue with a directory w/r permissions.. Thanks for the help! sorry for wasting your time.
Noah Talerman

Noah Talerman

03/26/2021, 9:52 PM
Glad you figured out the issue!
1
zwass

zwass

03/27/2021, 12:39 AM
@jsanchez did Fleet log any sort of error information that you could have used to find that? If not we might like to try to add some logging.
Noah Talerman

Noah Talerman

03/30/2021, 3:20 PM
@jsanchez which directory had issues with w/r permissions? We may also want to add this information to the troubleshooting steps.
j

jsanchez

03/30/2021, 6:06 PM
So fleet was issuing errors for not being able to open
/var/log/osquery
but since both status.log and result.log were configured to be placed there I was not able to see the issue until I changed the permissions on that directory. the file was created as root, and had no other permissions set for other users. I changed the permissions to allow r/w for our fleet user that runs
/usr/bin/fleet serve
:ty: 1