General question I compiled a package using the instructions

Question

General question I compiled a package using the instructions from the Github page I installed it to some Macs I have for testing I m not getting any results back when running the query I guess the question is is installing the package from package builder all I need to install to my endpoints or is there something else They enrolled and come up green but running queries does nothing Is there something else I need to initiate

defensivedepth · Answer

Have you confirmed that redis is running and configured for Fleet to be able to connect to it redis is a requirement for ad hoc non scheduled queries

David M · Answer

What s the best way to check I am using ElasticCache and confirmed that the server in EC2 can talk to EC over the correct port Looking at CloudWatch I see activity

David M · Answer

I wonder if I need to open the ports from EC back to the EC2 instance

defensivedepth · Answer

default config value for Fleet is `localhost 6379` make sure you have it config ed correctly gt <https github com kolide fleet blob master docs infrastructure configuring the fleet binary md redis>

David M · Answer

I do have it set to that

David M · Answer

Updating my Security Group

David M · Answer

Still doesn t seem to do anything I have 6379 open between ElasticCache and the Fleet server I have 3306 open between the RDS server and the Fleet server

sundsta · Answer

Look at the Fleet logs It will show if there is a timeout to redis

defensivedepth · Answer

Back online < David M> Let us know if you still run into issues after checking the Fleet logs like < sundsta> suggested

David M · Answer

tail f tmp osquery status right

sundsta · Answer

No The output from the `fleet` binary If you re running in Docker that s just the container s STDOUT or if you re using a VM you ll check the systemd logs with `sudo journalctl u fleet`

David M · Answer

Scrubbed the office IP out of the logs shown as lt scrubbed gt But this is the last 20 000 lines of the logs for Fleet

David M · Answer

Let me run a query and pull that part out of the logs to make it easier to see what we re getting

David M · Answer

Six minutes of logs I ran the query SELECT FROM osquery info during the window from one agent

sundsta · Answer

Is debug logging enabled The error looks like this `Aug 16 19 56 24 fleet rp7w fleet 1308 ts=2019 08 16T19 56 24 235866993Z component=service method=SubmitDistributedQueryResults ip addr= lt IP gt 57100 err= failed to ingest result writing results PUBLISH failed to channel results 259 dial tcp lt REDIS IP gt 6379 connect connection timed out took=2m10 36553587s`

David M · Answer

Added debug true and here are the logs I ran the query at 20 04 top line and the query stopped at 20 06 Looking for the osquery info in the query

sundsta · Answer

osquery info won t show Even with debug logging this is all that will show when a distributed query returns `Aug 16 20 18 50 fleet rp7w fleet 1308 ts=2019 08 16T20 18 50 436811847Z component=service method=SubmitDistributedQueryResults ip addr= lt IP gt 57188 err=null took=279 826207ms`

David M · Answer

So what would the next steps be for me I pretty much followed the couple of walkthroughs posted on Github and the Kolide blog