Title
#kolide
g

Gavin Chen

07/01/2019, 7:27 PM
Anyone around help with Kolide with Windows or am I in wrong channel again, I been asking question for like a week now and no luv
zwass

zwass

07/01/2019, 7:28 PM
If you ask your question we can try to help you. I see now that you replied a couple days after my last reply with the actual question so I can reply on that thread or you can start a new one.
g

Gavin Chen

07/01/2019, 7:29 PM
you told me to ask my question Kolide, I do not know how to use slack so if it can be answered here that would work?
zwass

zwass

07/01/2019, 7:30 PM
Is your question how to run Launcher as a service?
g

Gavin Chen

07/01/2019, 7:30 PM
It could be I have an entire miss understanding, ill try to explain and maybe it makes since to you.
7:31 PM
Im using Windows, I can get the host to sync with the Fleet on the ubuntu system just fine, no error I see it in Fleet etc, but when the cmd prompt closes the host falls out of Fleet
7:32 PM
So, one time you suggest I need to launch it as a service
7:32 PM
So I tried last few days to get it to run with osqueryd
7:32 PM
here is cmd line I used
zwass

zwass

07/01/2019, 7:33 PM
Typically anything you run on the cmd line will exit when you close the command line. So you'll need to run it as a service.
g

Gavin Chen

07/01/2019, 7:33 PM
When I look at the traffic in wireshark, it appears that the Fleet is responding to my windows host, but the Host will never show up in Fleet
zwass

zwass

07/01/2019, 7:34 PM
If you run that command not as a service, does it work?
g

Gavin Chen

07/01/2019, 7:35 PM
from what I can remember when I just run it as osqueryd it would only accept osquery secret and the hostname, my command line would never accept me pointing it to the flags file
zwass

zwass

07/01/2019, 7:36 PM
We always advise testing connecting osqueryd or Launcher to Fleet manually before trying to create a service. Have you connected it successfully manually ever?
g

Gavin Chen

07/01/2019, 7:36 PM
only successful with Launcher never with osqueryd which is why its confusing
7:37 PM
my thought was it was the exact same command line from launcher, then just simply replace with osqueryd but never had success, but then again I don't know if that is true
zwass

zwass

07/01/2019, 7:38 PM
That will certainly not work
g

Gavin Chen

07/01/2019, 7:38 PM
good to know
zwass

zwass

07/01/2019, 7:38 PM
Osquery requires many more flags than what Launcher does
7:38 PM
Which is part of the reason Launcher exists
g

Gavin Chen

07/01/2019, 7:38 PM
ah
zwass

zwass

07/01/2019, 7:38 PM
If you can make Launcher run successfully, why not run that as a service?
g

Gavin Chen

07/01/2019, 7:39 PM
I have no idea how any help be great, im not a computer guy im trying to get this settup for my 14 who loves computers
7:39 PM
im just trying my best to be a good dad, but no idea what im doing
7:40 PM
if you have a example screen shot to run launcher as a service, i be glad give that a shot
zwass

zwass

07/01/2019, 7:43 PM
Your sc.exe command may work if you just replace all the osqueryd arguments with the Launcher arguments.
g

Gavin Chen

07/01/2019, 7:44 PM
great good to know, ill give that a try at the house, I took that right off the website docs, but simply exchange that info with the launcher.exe instead of osqueryd
7:45 PM
appreciated
zwass

zwass

07/01/2019, 7:45 PM
You will want to use the full command line that you use to successfully start Launcher
g

Gavin Chen

07/01/2019, 7:45 PM
great I will give it a try after work thanks
zwass

zwass

07/01/2019, 7:46 PM
Good luck!
g

Gavin Chen

07/01/2019, 7:46 PM
ty
4:02 AM
Hmm the service created fine but will not start