Sure. How would you like it?
# kolideb
benbass
06/19/2019, 5:40 PMSure. How would you like it?
z
zwass
06/19/2019, 5:41 PM
Paste right into here would do
b
benbass
06/19/2019, 5:43 PMFor some reason it wouldn’t let me paste it right in.
benbass
06/19/2019, 5:43 PMTHe darwin override works just fine.
z
zwass
06/19/2019, 5:44 PM
And you know it doesn't work because you used --tls_dump and didn't see the correct config?
b
benbass
06/19/2019, 5:44 PMYup.
benbass
06/19/2019, 5:44 PMUsed --verbose and --tls_dump.
benbass
06/19/2019, 5:45 PMAt first I changed the distributed interval to be different to see what was being pulled.
benbass
06/19/2019, 5:45 PMthen saw it matched up with the default options.
benbass
06/19/2019, 5:45 PMWhen I change the default logger_path to the windows one, the endpoints log in and work just fine.
benbass
06/19/2019, 5:46 PMI would like to leave the default to a linux like format as we will be pulling in more random flavors of linux in the coming months, and don’t want to rely on a rhel override.
z
zwass
06/19/2019, 5:46 PM
Sure, makes sense
s
seph
06/19/2019, 5:58 PM
I’m not current on the fleet source code, but I suspect all the linux platform identification is pretty dicy. I put some comments around https://github.com/osquery/osquery/pull/5488
z
zwass
06/19/2019, 6:03 PM
What is the result of
select platform from os_versionb
benbass
06/19/2019, 6:07 PMwindows
benbass
06/19/2019, 6:07 PMI checked that. I am also seeing the same thing from a windows VM that is part of our standard build too.
z
zwass
06/19/2019, 6:08 PM
Do you have access to the Fleet MySQL db? Can you run
select * from osquery_options;b
benbass
06/19/2019, 6:09 PMsure - let me connect.
benbass
06/19/2019, 6:14 PMThis is from my prod server; it mirrored our dev until I made the changes to move the windows configs into the default, so this is what I started with.
benbass
06/19/2019, 6:15 PMz
zwass
06/19/2019, 6:16 PM
DB looks as I would expect. Does the darwin override work?
zwass
06/19/2019, 6:16 PM
Are you sure the osquery clients are connected to the server with this updated config?
b
benbass
06/19/2019, 6:17 PMYep. I have my atcs working.
benbass
06/19/2019, 6:17 PMThey are connecting and working on one where I had these exact options (i pushed this yaml config over)
benbass
06/19/2019, 6:18 PMbut only work when I change the default to have the logger_path.
benbass
06/19/2019, 6:18 PMthe windows clients don’t seem to work with the override for soem reason.
benbass
06/19/2019, 6:19 PMI’ll push config with the windows overrides back and see what happens.
z
zwass
06/19/2019, 6:19 PM
Can you
select * from hosts where platform = 'windows'zwass
06/19/2019, 6:19 PM
Doing all of this on the same server where you see things not working would be helpful
b
benbass
06/19/2019, 6:20 PMyup. let me push the configs back.
benbass
06/19/2019, 6:20 PM(yay dev environment)
benbass
06/19/2019, 6:25 PMAaaand it’s working now.
z
zwass
06/19/2019, 6:25 PM
😁
b
benbass
06/19/2019, 6:26 PMWhich is very odd, as I pushed the exact same configs from prod, which the clients were failing on yesterday too.
z
zwass
06/19/2019, 6:26 PM
All you really needed was a psyduck
b
benbass
06/19/2019, 6:26 PMquack.
z
zwass
06/19/2019, 6:26 PM
I think I'm the one who needs to be quacking 😉
zwass
06/19/2019, 6:26 PM
Anyway, glad you got it sorted.
b
benbass
06/19/2019, 6:26 PMyeah, hopefully things will work on new hosts. 🙂
benbass
06/19/2019, 6:26 PMThanks for the help!
z
zwass
06/19/2019, 6:27 PM
Yeah check in again if they don't
zwass
06/19/2019, 6:27 PM
I'd bet the signals got crossed on which servers the configs were being applied to and which the hosts were enrolling on
b
benbass
06/19/2019, 6:29 PMQuite possibly, but both servers had the same configs at first.
2 Views