Hi is it possible to determine the UUID of a node from a nod osquery #fleet

Hi, is it possible to determine the UUID of a node...

Ryan

07/18/2022, 4:36 PM

Hi, is it possible to determine the UUID of a node from a node key? I turned on the integration with Fleet and Sentry, and we got an error raised saying

authentication error: invalid node key: <node key here>

👀 1

Kathy Satterlee

07/18/2022, 5:00 PM

Hey, @Ryan! Where and when are you seeing that error?

Ryan

07/18/2022, 5:49 PM

Hi @Kathy Satterlee that’s after enabling the Sentry integration for Fleet. https://fleetdm.com/docs/deploying/configuration#dsn

Ryan

07/18/2022, 5:49 PM

Have only seen it once so far.

Ryan

07/18/2022, 5:49 PM

Have seen this one a few times though: https://osquery.slack.com/archives/C01DXJL16D8/p1658162259497449

Kathy Satterlee

07/18/2022, 6:11 PM

That one is just happening because that route is protected and it should automatically redirect to login.

Kathy Satterlee

07/18/2022, 6:12 PM

Let me reach out to the team about Sentry.

Kathy Satterlee

07/18/2022, 7:12 PM

It looks like the best options for narrowing down which host is causing that error would be to either directly query the

hosts

table in the Fleet database to find the host with the corresponding

node_key

or to use the REST API. Once you've found the culprit, delete the host from Fleet and it should attempt to reregister.

Ryan

07/20/2022, 2:25 PM

ok thanks, I’ll give that a try

Ryan

07/20/2022, 2:31 PM

no results for that node key weirdly

Ryan

07/20/2022, 2:33 PM

perhaps the node was being decommissioned at the time?

Kathy Satterlee

07/20/2022, 2:45 PM

Sounds like that could be the case. Might have just been a weird one-off at the time of the request.

Ryan

07/20/2022, 5:14 PM

yeah, I’ll keep an eye out for any more 😄

12 Views

Open in Slack

Previous Next