https://github.com/osquery/osquery logo
Title
r

Ryan

07/11/2022, 2:44 PM
Hi, I upgraded to 4.17.0 today, but since then I can’t get live queries to work, was there any major change I missed between v4.10.0 and v4.17.0?
it appears to hang indefinitely in this stage:
if I check the web server logs, I do see an odd 405 “method not allowed” for the
POST /api/v1/fleet/results/138/tlqktdd1/jsonp_send?i=anefvhryk
If I try with
fleetctl
I get the following:
Error: upgrade live query result websocket: websocket: bad handshake
Looks like it’s definitely the Nginx server in between that is the problem.
n

Noah Talerman

07/11/2022, 2:56 PM
Ryan, here’s a GitHub issue that includes context when other folks experienced a similar issue: https://github.com/fleetdm/fleet/issues/6049
r

Ryan

07/11/2022, 2:58 PM
nice, thanks!
was still checking the docs
ah yes this looks like the fella
(we didn’t run this version, have skipped past it)
I think we must’ve had the same issue then - websockets inadvertently blocked, and the fallback SocksJS was working instead, but now is not
All fixed now, thanks @Noah Talerman, I should’ve really checked the GitHub issues before posting here 🤔 🤦 😂
n

Noah Talerman

07/11/2022, 3:34 PM
Glad you resolved the issue! Always happy to help :)
r

Ryan

07/12/2022, 9:57 AM
Just an update for you - live queries seem WAY more responsive than before, so I suspect the real websocket approach is much better.
🤟 1
Though there is an occasional “freeze” for bigger queries in Safari, like it’ll get to 55% of hosts responded, then nothing happens, and if you try to scroll the table, it stops rendering updates completely, so there’s just empty space…
I don’t have this problem in Chrome, so I suspect it’s a Safari issue?
n

Noah Talerman

07/12/2022, 1:39 PM
occasional “freeze” for bigger queries in Safari, like it’ll get to 55% of hosts responded, then nothing happens
Sorry you’re running into this issue. This sounds like a possible bug in Fleet. If you’re comfortable, do you mind sharing a screen recording of this behavior? This way, the Fleet team can attempt to reproduce.
r

Ryan

07/12/2022, 2:04 PM
@Noah Talerman sure, I could do a screenshare some time maybe?
n

Noah Talerman

07/12/2022, 2:36 PM
That sounds great! Please feel free to book some time here on my calendly: https://calendly.com/noahtalerman/chat