Can you provide the server response to the enrollment reques

Question

Can you provide the server response to the enrollment request like you did for <https osquery slack com archives C1XCLA5DZ p1519324487000723>

Newbee · Answer

I0222 16 23 43 138703 4476 tls enroll cpp 63 TLSEnrollPlugin requesting a node enroll key from I0222 16 23 43 138703 4544 interface cpp 89 Thrift message TPipe GetOverlappedResult errored GLE=errno = 109 I0222 16 23 43 138703 4544 interface cpp 89 Thrift message TConnectedClient died TPipe GetOverlappedResult failed I0222 16 23 43 138703 5656 interface cpp 89 Thrift message TPipe GetOverlappedResult errored GLE=errno = 109 I0222 16 23 43 138703 5656 interface cpp 89 Thrift message TConnectedClient died TPipe GetOverlappedResult failed I0222 16 23 43 810552 4416 tls enroll cpp 63 TLSEnrollPlugin requesting a node enroll key from I0222 16 23 43 810552 2784 interface cpp 89 Thrift message TPipe GetOverlappedResult errored GLE=errno = 109 I0222 16 23 43 810552 2784 interface cpp 89 Thrift message TConnectedClient died TPipe GetOverlappedResult failed I0222 16 23 43 810552 5916 interface cpp 89 Thrift message TPipe GetOverlappedResult errored GLE=errno = 109 I0222 16 23 43 810552 5916 interface cpp 89 Thrift message TConnectedClient died TPipe GetOverlappedResult failed I0222 16 23 43 841809 2652 tls enroll cpp 63 TLSEnrollPlugin requesting a node enroll key from I0222 16 23 43 841809 5588 interface cpp 89 Thrift message TPipe GetOverlappedResult errored GLE=errno = 109 I0222 16 23 43 841809 5588 interface cpp 89 Thrift message TConnectedClient died TPipe GetOverlappedResult failed I0222 16 23 43 841809 2240 interface cpp 89 Thrift message TPipe GetOverlappedResult errored GLE=errno = 109 I0222 16 23 43 841809 2240 interface cpp 89 Thrift message TConnectedClient died TPipe GetOverlappedResult failed I0222 16 23 45 185578 4476 tls cpp 198 TLS HTTPS POST request to URI enroll enroll secret xxxxxxxxxxxxxxxxxxxxxxxxxxx host identifier 9DC61442 B7FD B9B6 1BB5 320C5EA0D064 platform t ype 2 host details

Newbee · Answer

node key RtRfZCDgLdkpW8kC1bAbr 7dth2rWmK8 I0222 16 23 45 232504 4476 tls cpp 198 TLS HTTPS POST request to URI

Newbee · Answer

node key RtRfZCDgLdkpW8kC1bAbr 7dth2rWmK8 I0222 16 23 45 232504 4476 tls cpp 198 TLS HTTPS POST request to URI

Newbee · Answer

node key RtRfZCDgLdkpW8kC1bAbr 7dth2rWmK8 queries node key ZsnK6vcW7sHaXFiAELqWECOaQa2oFwyf I0222 16 23 45 935539 2652 tls cpp 198 TLS HTTPS POST request to URI <https x x x x 8080 api v1 osquery> config node key ZsnK6vcW7sHaXFiAELqWECOaQa2oFwyf error authentication error invalid node key O k3jqhlx2XX6xb3FEyeM ePDk3B3Zg1 node invalid true

zwass · Answer

Did these logs all occur sequentially in a single run of `osqueryd` I see three different node keys here Some successful looking requests some unsuccessful And perhaps a mysteriously corrupted node key It s hard to really make sense of it Maybe including the whole log from a single run of `osqueryd` would help

Newbee · Answer

Let me log everything to a file and send it to you

Newbee · Answer

Very wierd I changed host identifier in my flag file to hostname from uuid and it worked

zwass · Answer

Possibly there is some bug in osquery If you can repro this please file an issue