Title
#fleet
c

Chris Reisor

02/05/2021, 10:23 PM
How might I determine if an osqueryd is failing to enroll with fleet? I know I can check logs, but I'm trying to figure out a way to monitor all my hosts to ensure they're all enrolled and communicating with fleet? I was hoping there was an osquery table / field for this but I couldn't find anything that differed between one of my enrolled osqueryd hosts and one of the ones having issues.
z

Zach Zeid

02/06/2021, 12:15 AM
that's not a really helpful command, I've used this in the past
sudo osqueryd 
--verbose 
--tls_dump 
--tls_hostname <hostname> 
--config_plugin tls 
--config_tls_endpoint /api/v1/osquery/config
--logger_tls_endpoint /api/v1/osquery/log 
--logger_plugin tls,aws_firehose 
--enroll_tls_endpoint /api/v1/osquery/enroll 
--enroll_secret_path /etc/osquery/enroll_secret 
--distributed_tls_write_endpoint /api/v1/osquery/distributed/write 
--distributed_tls_read_endpoint /api/v1/osquery/distributed/read
--tls_client_cert <cert filepath>
--tls_client_key <key filepath>
zwass

zwass

02/06/2021, 3:06 AM
I wonder how you could get the info from osquery if the host was not enrolled? Are you thinking you would perhaps SSH onto the host and run something with osquery there? We've been thinking about how to make enrollment debugging easier and would be curious to hear more about your thoughts.
Esteban

Esteban

02/08/2021, 1:41 PM
I'm used to check Windows "Event Log" on Application Logs, it's really helpful
c

Chris Reisor

02/08/2021, 3:09 PM
Rather than ssh to hosts, I was actually thinking of writing some kind of nagios check that would run on each host.