Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey - I just rebooted my (M1) Mac, and now the fleet desktop app is crashing and respawning. Any logs I can check to see whats happening ?

Hi <@UALA3C5BM>, thanks for reaching out! The logs for Fleet Desktop are available at `$HOME/Library/Logs/Fleet/fleet-desktop.log`. Please let me know what you find!

If those logs point to an issue elsewhere with Fleet or osquery, there's some great info in the <https://fleetdm.com/docs/deploying/debugging|Fleet Docs on debugging>.

```2022-07-07T15:00:15-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:15-04:00 INF ready
2022-07-07T15:00:25-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:25-04:00 INF ready
2022-07-07T15:00:36-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:36-04:00 INF ready
2022-07-07T15:00:47-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:47-04:00 INF ready```

Hi folks. Could you also check Orbit+osquery logs? (The whole thing is probably loop-crashing)
`/var/log/orbit/orbit.stderr.log`

`2022-07-07T16:08:15-04:00 ERR unexpected exit error="opening socket transport: dial unix /opt/orbit/orbit-osquery.em: connect: connection refused"`

Ah yes, you can fix the issue by removing that file manually `sudo rm /opt/orbit/orbit-osquery.em`.

Will be fixed on next Orbit release: <https://github.com/fleetdm/fleet/pull/6474>

thanks. Thought that would fix it but it was worth asking

Thank you for letting us know, we actually hit this bug internally.

1. Could you share us the osquery version? 
2. It basically started failing after a reboot?

```✦ ❯ ./bin/orbit/orbit --version
orbit 0.0.13```

```❯ ./bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd --version
osqueryd version 5.3.0```

Ah sorry, meant version of the osqueryd executable within orbit directory

2. Yes, after a reboot (and my mac was acting a little screwy which is why I rebooted.

(I put both versions of orbit and osqueryd up there)