https://github.com/osquery/osquery logo
Powered by
#fleet
Title
# fleet
j

Jason

07/07/2022, 6:39 PM
Hey - I just rebooted my (M1) Mac, and now the fleet desktop app is crashing and respawning. Any logs I can check to see whats happening ?
k

Kathy Satterlee

07/07/2022, 6:55 PM
Hi @Jason, thanks for reaching out! The logs for Fleet Desktop are available at 
$HOME/Library/Logs/Fleet/fleet-desktop.log
. Please let me know what you find! If those logs point to an issue elsewhere with Fleet or osquery, there's some great info in the Fleet Docs on debugging.
j

Jason

07/07/2022, 7:01 PM
thanks for the fast reply.
hm, it seems its just a lot of this:
Copy code
2022-07-07T15:00:15-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:15-04:00 INF ready
2022-07-07T15:00:25-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:25-04:00 INF ready
2022-07-07T15:00:36-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:36-04:00 INF ready
2022-07-07T15:00:47-04:00 INF fleet-desktop version=0.0.3
2022-07-07T15:00:47-04:00 INF ready
l

Lucas Rodriguez

07/07/2022, 7:02 PM
Hi folks. Could you also check Orbit+osquery logs? (The whole thing is probably loop-crashing) 
/var/log/orbit/orbit.stderr.log
j

Jason

07/07/2022, 8:09 PM
is this perhaps relevant?
2022-07-07T16:08:15-04:00 ERR unexpected exit error="opening socket transport: dial unix /opt/orbit/orbit-osquery.em: connect: connection refused"
l

Lucas Rodriguez

07/07/2022, 9:05 PM
Ah yes, you can fix the issue by removing that file manually 
sudo rm /opt/orbit/orbit-osquery.em
.
Will be fixed on next Orbit release: https://github.com/fleetdm/fleet/pull/6474
j

Jason

07/07/2022, 9:06 PM
thanks. Thought that would fix it but it was worth asking
l

Lucas Rodriguez

07/07/2022, 9:11 PM
Thank you for letting us know, we actually hit this bug internally. 1. Could you share us the osquery version? 2. It basically started failing after a reboot?
j

Jason

07/07/2022, 9:11 PM
Copy code
✦ ❯ ./bin/orbit/orbit --version
orbit 0.0.13
Copy code
❯ ./bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd --version
osqueryd version 5.3.0
l

Lucas Rodriguez

07/07/2022, 9:12 PM
Ah sorry, meant version of the osqueryd executable within orbit directory
j

Jason

07/07/2022, 9:12 PM
2. Yes, after a reboot (and my mac was acting a little screwy which is why I rebooted.
Also, on an M1 just as an FYI
(I put both versions of orbit and osqueryd up there)
l

Lucas Rodriguez

07/07/2022, 9:16 PM
👍
7 Views
Powered by