Sorry the edit period timed out and I didn t finish writing

Question

Sorry the edit period timed out and I didn t finish writing < seph> oops fg svc instead of svc fg That would be the problem Yes it isn t reading the config file because I was using fg svc I expect that will fix that problem now I ll check on Saturday it is weekend in this country now The launcher flag file is the same as on all the computers that I m deploying with that MSI file and the others are working This computer is one that is not reporting at all I have another one I m looking at now which was reporting but has stopped This one gives me this log below when I run it in foreground using the correct command you reminded me of slightly smiling face I m actually wondering if it might be having the same problem In Services msc this one shows that the service is running it doesn t stop with an error yet kolide server shows it is offline If I then stop the service and use the svc fg command I get the result below even though I have confirmed that the launcher service is definitely stopped So this time I took a backup of the C program files kolide folder before uninstalling In case you want it to check anything deleting the kolide folder and reinstalling it However reinstalling it did not fix the problem C Program Files Kolide Launcher launcher bin launcher exe svc fg config C Program Files Kolide Launcher launcher conf launcher flags ts=2019 05 16T08 38 59 2118496Z caller=svc windows go 58 severity=debug msg= foreground service start requested debug mode ts=2019 05 16T08 38 59 2178439Z caller=svc windows go 79 severity=debug msg= windows service starting ts=2019 05 16T08 38 59 225839Z caller=svc windows go 88 severity=info msg= runLauncher exited err= open launcher db open C Program Files Kolide Launcher launcher data launcher db Access is denied stack= open C Program Files Kolide Launcher launcher data launcher db Access is denied nopen launcher db nmain runLauncher n t Users seph go src github com kolide launcher cmd launcher launcher go 227 nmain winSvc Execute func1 n t Users seph go src github com kolide launcher cmd launcher svc windows go 86 nruntime goexit n t usr local Cellar go 1 12 2 libexec src runtime asm amd64 s 1337

Stephen · Answer

So I was able to test the computer that was not reporting to kolide at all by using svc fg instead of fg svc it was able to give me a proper result But the result seems to say that there is a permission problem somewhere C Program Files Kolide Launcher launcher bin launcher exe svc fg config C Program Files Kolide Launcher launcher conf launcher flags ts=2019 05 18T07 36 21 152066Z caller=svc windows go 58 severity=debug msg= foreground service start requested debug mode ts=2019 05 18T07 36 21 152561Z caller=svc windows go 79 severity=debug msg= windows service starting ts=2019 05 18T07 36 21 1540856Z caller=svc windows go 88 severity=info msg= runLauncher exited err= open launcher db open C Program Files Kolide Launcher launcher data launcher db Access is denied stack= open C Program Files Kolide Launcher launcher data launcher db Access is denied nopen launcher db nmain runLauncher n t Users seph go src github com kolide launcher cmd launcher launcher go 227 nmain winSvc Execute func1 n t Users seph go src github com kolide launcher cmd launcher svc windows go 86 nruntime goexit n t usr local Cellar go 1 12 5 libexec src runtime asm amd64 s 1337 so I uninstalled launcher deleted the c program files kolide folder no trouble deleting it rebooted and reinstalled and when I test it I still get the same error with permissions What should I try next

Stephen · Answer

If you compare the results from both these computers one of them has never talked to kolide the other one did talk previously but has stopped both of them have a kolide launcher service that stops soon after it starts both of them are having Access is denied errors when I run svc fg to find out what is really going on So it looks to me that they are both actually experiencing the same problem So I d appreciate any advice on how to investigate this further

Stephen · Answer

I ve just found another computer experiencing this problem All three of them have at one point had an earlier version of kolide launcher on them 2 out of three have had launcher uninstalled and the folder deleted and reinstalled and haven t improved at all the third one I haven t tried this as it is on the other side of the country