Any ideas on how to troubleshoot this further

Question

zwass · Answer

See <https github com kolide launcher issues 445 issuecomment 762975944> We can t really do anything on the Fleet side since the data never touches us

seph · Answer

I updated <https github com kolide launcher pull 481> as an approach to handling this But I don t have a way to test this

seph · Answer

Do you have enough of a test bed that you can test a build and if so can you build that branch or do you want me to

defensivedepth · Answer

First off thanks < zwass> < seph> for looking into this more The user on that thread B3DTech is using osquery with Security Onion and posted that error over on our support forum which is why I brought it up over here I actually havent been able to duplicate the issue on my side

defensivedepth · Answer

I will carve out some more time next week to see if I can replicate it and then eventually test that branch

seph · Answer

Cool Thanks

seph · Answer

Feel free to update the PR if it seems reasonable to you

defensivedepth · Answer

So the good news here is that Launcher was still trying to send mis formatted osquery logs from when they had osquery lt 4 5 1 installed once we blew away the rocksdb we can t reproduce the utf8 errors

seph · Answer

Okay I m glad that the underlying bug in osquery seems fixed I think there s still thing weird in launcher if it can t send a log it gets stuck But this is somewhat intentional it s designed not to lose information