Erich Stoekl
04/28/2020, 6:59 PM--verbose
and --tls_dump
to see all data. I see that the osquery node is polling the read endpoint (api/v1/osquery/distributed/read
) with the correct node key. It usually just gets back an empty queries:
response. Sometimes, however, it gets the proper query and runs it! It seems to run it about 10% of the time.
Also notable is that creating packs/scheduling queries works 100% of the time.
My Fleet server is deployed behind an HAProxy LB. The LB uses its own certificates (signed, wildcard), and my Fleet server uses self-signed certs. The osquery node is using the public key pem
file for the LB cert, and it enrolls properly.
Anyone have any ideas?sundsta
04/28/2020, 7:27 PMErich Stoekl
04/28/2020, 8:46 PMzwass
Erich Stoekl
04/29/2020, 5:01 PMzwass
Erich Stoekl
04/29/2020, 5:36 PMzwass
Erich Stoekl
04/29/2020, 9:48 PMLiveQuery
method in server/service/client_live_query.go
but I'm having trouble figuring out what the websocket is doingzwass
Erich Stoekl
04/29/2020, 11:25 PMWebSocket connection to '<wss://my-kolide-svc.my-company.com/api/v1/kolide/results/207/efwfuaj3/websocket>' failed: WebSocket is closed before the connection is established.
However I see in the network tab that the websocket performed the content download and it took 2.26 ms.
When executing the live query through the LB, I see in the network tab that the websocket is initiated, but it just hangs there.