Is there a difference in how fleet manages scheduled packs already on endpoints vs. ones that are created through the UI? I see results from the packs already existing on the endpoints, but I don't see anything from scheduled packs I create through the UI.

Do you have

--config_tls_endpoint

set?

yeah I do

"config_tls_endpoint": "/api/v1/osquery/config",

If osquery is reading configs from disk it's not reading configs from Fleet

I do have that set

That is being sent from Fleet?

I manually edited this..

I would add

--verbose --tls_dump

to the osquery flags so you can see (1) whether osquery is requesting config from Fleet and (2) what Fleet is returning

the host does get enrolled because it does show up in the dashboard, but I don't see any logs being generated at all.

You'll need to run osquery in verbose mode and see the network comms

huh,

I0820 18:40:36.960268 28460 glog_logger.cpp:44] Could not get RPM header flag.

over and over again.

Seems unrelated

ah interesting! I had both

--verbose

and

--tls_dump

set in

osquery.flags

but it wasn't actually doing anything. running

osqueryd

with those flags shows something.

No, this is a live query request

ok, then that's where I'm confused, I'm sure this is a mostly correct config

"options": {
		"config_refresh": "600",
		"logger_plugin": "tls",
		"tls_server_certs": "/etc/osquery/certs/somecert.crt",
		"tls_client_key": "/etc/osquery/certs/somekey.key",
		"tls_hostname": "<http://fleet.beep.boop.org|fleet.beep.boop.org>",
		"enroll_tls_endpoint": "/api/v1/osquery/enroll",
		"config_plugin": "tls",
		"config_tls_endpoint": "/api/v1/osquery/config",
		"config_refresh": "10",
		"disable_distributed": "false",
		"distributed_plugin": "tls",
		"distributed_interval": "10",
		"distributed_tls_max_attempts": "3",
		"distributed_tls_read_endpoint": "/api/v1/osquery/distributed/read",
		"distributed_tls_write_endpoint": "/api/v1/osquery/distributed/write",
		"logger_tls_endpoint": "/api/v1/osquery/log",
		"logger_tls_period": "10",
		"schedule_splay_percent": "10",
		"pidfile": "/var/run/osquery.pidfile",
		"events_expiry": "3600",
		"database_path": "/var/osquery/osquery.db",
		"disable_tables": "",
		"read_max": "100000",
		"events_max": "100000",
		"host_identifier": "uuid",
		"logger_min_status": 0,
		"disable_logging": false,
		"utc": "true"
	},

I'm not sure that you can load a config from disk first and then osquery will switch to TLS. Typically folks hook everything up with a flagfile and serve the config from TLS.

🤔 so more something like this?

cat /etc/osquery/osquery.flags 
Ansible managed
--config_plugin=filesystem, tls
--config_path=/etc/osquery/osquery.conf
--config_refresh=600
--watchdog_level=1
--tls_dump
--verbose
--extensions_socket=/var/osquery/osquery.em
--pidfile=/var/run/osquery.pidfile

Yes, but you have an invalid value for config_plugin and you need to set the rest of the flags for connecting to fleet.

I'll doubly check them, this got me a lot further. Thank you!

There's a complete example of flags in https://github.com/kolide/fleet/blob/master/docs/infrastructure/adding-hosts-to-fleet.md#launching-osqueryd

I was able to get this working, thanks for your help!