https://github.com/osquery/osquery logo
Powered by
Title
n

nyanshak

07/29/2020, 5:15 PM
re: 3.0.0 fleet upgrades - I think the upgrade guide maybe should add some warnings about the deadlock issue in general. But also - label yaml spec has changed a bit, but I didn't see anything about it in the upgrade guide. 
applying labels: apply labels received status 500 Unknown Error: invalid LabelType: 1
^ already fixed in my environment, but would be nice to know about this in the upgrade guide, or have fleetctl offer to upgrade between formats.
(seems like maybe a good case for changing 
apiVersion
in the yaml specs to 
v2
?)
oh and probably the apply labels endpoint should return a 400 Bad Request instead of failing with 500?
z

zwass

07/29/2020, 8:43 PM
Yeah, I will investigate this. We can fix for the next release which will be shortly.
n

nyanshak

07/29/2020, 8:49 PM
oh and btw - P99 latency has dropped significantly for my deployments since deploying
still haven't done load-testing w/ live queries / the 'additional queries' stuff
but we're very pleased with these changes 🎉
thank you!
z

zwass

07/29/2020, 9:07 PM
Awesome! Really glad to hear it!
If you are able to share (anonymously or not) some stats about the hardware you are using and load it is supporting once everything has been tested and stabilized that would be super helpful. Folks often ask for hardware requirements and I'd love to document some real world deployments.
n

nyanshak

07/29/2020, 9:10 PM
Will be a while before I can carve out time from planned work to do that, but probably can share some of that data.
I'll have to check with some folks here first though
z

zwass

07/29/2020, 9:13 PM
Thank you!
@nyanshak can you provide the yaml you used that caused this error? I'm not immediately able to reproduce.
n

nyanshak

08/03/2020, 6:11 PM
---
apiVersion: v1
kind: label
name: CentOS Linux
description: All CentOS hosts
query: SELECT 1 FROM os_version WHERE platform = 'centos' OR name LIKE '%centos%';
label_type: 1
^ I think that should do it
as an example
Not sure if you'll hit the same thing with 
label_type: 1
, but you could try as well 🤷
z

zwass

08/03/2020, 6:13 PM
Is this yaml that was returned to you by 
fleetctl get label foobar
?
n

nyanshak

08/03/2020, 6:13 PM
Not sure, been a pretty long time since I initially set up the labels.
but it might be? 🤷
z

zwass

08/03/2020, 6:13 PM
kk
I don't think we changed anything with 
label_type
in 3.0 so this might be an old issue.
But I'll dig
n

nyanshak

08/03/2020, 6:14 PM
label_type is now "builtin" or "regular" I think
which may have changed in 2.6.0 or something, I'm not sure
instead of 0 / 1
z

zwass

08/03/2020, 6:17 PM
I modified your yaml to 
---
apiVersion: v1
kind: label
spec:
  name: CentOS Linux
  description: All CentOS hosts
  query: SELECT 1 FROM os_version WHERE platform = 'centos' OR name LIKE '%centos%';
  label_type: 1
and I get 
unmarshaling label spec: error unmarshaling JSON: invalid LabelType: 1
I wonder how yours actually hit the server? Possible you were using an older version of 
fleetctl
?
n

nyanshak

08/03/2020, 6:18 PM
ah yeah, probably was using 2.5.0 fleetctl
👍 1
#kolideJoin Slack
Powered by