Dan Achin
03/15/2021, 7:49 PM--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=3600
We still have the following in osquery.flags
--enroll_secret_path=REDACTED
--tls_hostname=REDACTED
--host_identifier=uuid
--enroll_tls_endpoint=/api/v1/osquery/enroll
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=60
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
-–watchdog_memory_limit=500
I'm seeing some strange stuff in this test environment. The hosts will register to fleet, but if you refresh fleet UI, every 10 - 15 seconds or so the hosts will flap between offline and online. Additionally, we aren't logging ANY query results at fleet for these nodes even though we have a few simple ones scheduled. When I run osquery in debug on these nodes, I see the registration, but no decorators, options, packs or queries. I tried adding back in config_plugin=tls and then started to get a bunch of errors about enrolling too often.zwass
03/15/2021, 11:34 PMDan Achin
03/16/2021, 12:13 AM