Erich Stoekl04/28/2020, 6:59 PM
to see all data. I see that the osquery node is polling the read endpoint (
) with the correct node key. It usually just gets back an empty
response. Sometimes, however, it gets the proper query and runs it! It seems to run it about 10% of the time. Also notable is that creating packs/scheduling queries works 100% of the time. My Fleet server is deployed behind an HAProxy LB. The LB uses its own certificates (signed, wildcard), and my Fleet server uses self-signed certs. The osquery node is using the public key
file for the LB cert, and it enrolls properly. Anyone have any ideas?
sundsta04/28/2020, 7:27 PM
Erich Stoekl04/28/2020, 8:46 PM
Erich Stoekl04/29/2020, 5:01 PM
Erich Stoekl04/29/2020, 5:36 PM
Erich Stoekl04/29/2020, 9:48 PM
but I'm having trouble figuring out what the websocket is doing
Erich Stoekl04/29/2020, 11:25 PM
However I see in the network tab that the websocket performed the content download and it took 2.26 ms. When executing the live query through the LB, I see in the network tab that the websocket is initiated, but it just hangs there.
WebSocket connection to '<wss://my-kolide-svc.my-company.com/api/v1/kolide/results/207/efwfuaj3/websocket>' failed: WebSocket is closed before the connection is established.