Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
j
Jason
07/07/2022, 6:39 PMHey - I just rebooted my (M1) Mac, and now the fleet desktop app is crashing and respawning. Any logs I can check to see whats happening ?
k
Kathy Satterlee
07/07/2022, 6:55 PMHi @Jason, thanks for reaching out! The logs for Fleet Desktop are available at
$HOME/Library/Logs/Fleet/fleet-desktop.logj
Jason
07/07/2022, 7:01 PMthanks for the fast reply.
hm, it seems its just a lot of this:
2022-07-07T15:00:15-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:15-04:00 INF ready
2022-07-07T15:00:25-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:25-04:00 INF ready
2022-07-07T15:00:36-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:36-04:00 INF ready
2022-07-07T15:00:47-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:47-04:00 INF readyl
Lucas Rodriguez
07/07/2022, 7:02 PMHi folks. Could you also check Orbit+osquery logs? (The whole thing is probably loop-crashing)
/var/log/orbit/orbit.stderr.logj
Jason
07/07/2022, 8:09 PMis this perhaps relevant?
2022-07-07T16:08:15-04:00 ERR unexpected exit error="opening socket transport: dial unix /opt/orbit/orbit-osquery.em: connect: connection refused"l
Lucas Rodriguez
07/07/2022, 9:05 PMAh yes, you can fix the issue by removing that file manually
sudo rm /opt/orbit/orbit-osquery.emWill be fixed on next Orbit release: https://github.com/fleetdm/fleet/pull/6474
j
Jason
07/07/2022, 9:06 PMthanks. Thought that would fix it but it was worth asking
l
Lucas Rodriguez
07/07/2022, 9:11 PMThank you for letting us know, we actually hit this bug internally.
1. Could you share us the osquery version?
2. It basically started failing after a reboot?
j
Jason
07/07/2022, 9:11 PM✦ ❯ ./bin/orbit/orbit --version
orbit 0.0.13❯ ./bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd --version
osqueryd version 5.3.0l
Lucas Rodriguez
07/07/2022, 9:12 PMAh sorry, meant version of the osqueryd executable within orbit directory
j
Jason
07/07/2022, 9:12 PM2. Yes, after a reboot (and my mac was acting a little screwy which is why I rebooted.
Also, on an M1 just as an FYI
(I put both versions of orbit and osqueryd up there)
l
Lucas Rodriguez
07/07/2022, 9:16 PM👍