Title
#kolide
t

taurian007

04/12/2020, 9:38 PM
will be appreciated
d

DG

04/13/2020, 3:58 PM
Windows Powershell -> Convertfrom-Json (ConvertFrom-Json '{"caller":"publish_results.go:168","err":"rpc error: code = Unknown desc = submitting distributed query results: failed to ingest result: ingesting query kolide_detail_query_network_interface: strconv.Atoi: parsing "unknown": invalid syntax","errcode":"","message":"","method":"PublishResults","reauth":false,"results":"[{\"query_name\":"kolide_label_query_9","status":0,\"rows\":null},{"query_name":\"kolide_label_query_6\",\"status\":0,"rows":[{\"1\":"1"}]},{"query_name":\"kolide_detail_query_network_interface\",\"status\":0,"rows":[{\"address\":"172.31.31.171","broadcast":\"172.31.31.255\",\"collisions\":"0","flags":\"69699\",\"ibytes\":"566637713","idrops":\"0\",\"ierrors\":"0","interface":\"eth0\",\"ipackets\":"410793","last_change":\"-1\",\"link_speed\":"0","mac":\"06:4a:24:ea:91:b0","mask":\"255.255.240.0\",\"metric\":"0","mtu":\"9001\",\"obytes\":"29204840","odrops":\"0\",\"oerrors\":"0","opackets":\"121800\",\"pci_slot\":"vif-0","point_to_point":\"\",\"type\":"unknown"}]},{"query_name":\"kolide_detail_query_os_version\",\"status\":0,"rows":[{\"build\":"","codename":\"bionic\",\"major\":"18","minor":\"4\",\"name\":"Ubuntu","patch":\"0\",\"platform\":"ubuntu","platform_like":\"debian\",\"version\":"18.04.4 LTS (Bionic Beaver)"}]},{"query_name":\"kolide_detail_query_osquery_flags\",\"status\":0,"rows":[{\"name\":"config_refresh","value":\"300\"},{\"name\":"distributed_interval","value":\"10\"},{\"name\":"logger_tls_period","value":\"10\"}]},{\"query_name\":"kolide_detail_query_osquery_info","status":0,\"rows\":[{"build_distro":\"centos7\",\"build_platform\":"1","config_hash":\"ca23eeb39a7191a39e45b26d43c771fd3700a9c8\",\"config_valid\":"1","extensions":\"active\",\"instance_id\":"2d802ca0-8bbb-4dde-bef2-3aab5320495a","pid":\"24928\",\"platform_mask\":"9","start_time":\"1586726840\",\"uuid\":"8f8bd4d8-a6be-4210-a533-6f22696be406","version":\"4.2.0\",\"watcher\":"-1"}]},{"query_name":\"kolide_detail_query_system_info\",\"status\":0,"rows":[{\"computer_name\":"ip-172-31-31-171","cpu_brand":"Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz","cpu_logical_cores":\"1\",\"cpu_microcode\":"0x43","cpu_physical_cores":\"1\",\"cpu_subtype\":"63","cpu_type":\"x86_64\",\"hardware_model\":"","hardware_serial":\"\",\"hardware_vendor\":"","hardware_version":\"\",\"hostname\":"ip-172-31-31-171.eu-west-1.compute.internal","local_hostname":\"ip-172-31-31-171.eu-west-1.compute.internal\",\"physical_memory\":"1031475200","uuid":\"8f8bd4d8-a6be-4210-a533-6f22696be406\"}]},{\"query_name\":"kolide_detail_query_uptime","status":0,\"rows\":[{"days":\"0\",\"hours\":"15","minutes":\"11\",\"seconds\":"45","total_seconds":\"54705\"}]}]","severity":"info","took":"2.941317ms","ts":"2020-04-12T21:27:31.678535667Z","uuid":"a457454b-8bba-479c-b066-bb0a17aabe96"}').results
3:58 PM
Give: query_name status rows---------- ------ ---- kolide_label_query_9 0 kolide_label_query_6 0 {@{1=1}} kolide_detail_query_network_interface 0 {@{address=172.31.31.171; broadcast=172.31.31.255; collisions=0; flags=... kolide_detail_query_os_version 0 {@{build=; codename=bionic; major=18; minor=4; name=Ubuntu; patch=0; pl... kolide_detail_query_osquery_flags 0 {@{name=config_refresh; value=300}, @{name=distributed_interval; value=... kolide_detail_query_osquery_info 0 {@{build_distro=centos7; build_platform=1; config_hash=ca23eeb39a7191a3... kolide_detail_query_system_info 0 {@{computer_name=ip-172-31-31-171; cpu_brand=Intel(R) Xeon(R) CPU E5-26... kolide_detail_query_uptime 0 {@{days=0; hours=15; minutes=11; seconds=45; total_seconds=54705}}
4:12 PM
Or perhaps build being Null
4:12 PM
build : codename : bionic major : 18 minor : 4 name : Ubuntu patch : 0 platform : ubuntu platform_like : debian version : 18.04.4 LTS (Bionic Beaver)
4:19 PM
So if it is really the error it says -> ingesting query kolide_detail_query_network_interface: strconv.Atoi: parsing "unknown". Then thats the result of "type":"unknown"
4:22 PM
Most results i read like Issue 1521 (which is the output "", instead of UNKNOWN - say this was fixed in later versions
t

taurian007

04/13/2020, 5:26 PM
Yes I updated the kolide fleet to latest version and it is fixed now
zwass

zwass

04/13/2020, 5:40 PM
Which version of Fleet were you using?