Title
#windows
k

koba

10/20/2020, 9:45 AM
When i run
osqueryd.exe
as a process I am able to enroll my windows host. But when i configure a
service
. Same host doesn't come online in my Kolide web console. I have also enabled
Windows Event Log support
as described here. Event logs also doesn't show any entries. Where to look for further troubleshooting? PS: I'm using
manage-osqueryd.ps1
for configuring the my service.
zwass

zwass

10/20/2020, 4:27 PM
You need to make sure you are running the service with the same configuration as the process. Try putting all the flags you are using for the process into a flagfile and then providing that to the service.
k

koba

10/20/2020, 4:49 PM
Thanks @zwass I made sure. It's the exact same flag file. Shouldn't there be a better way to diagnose? Am I missing something...are there any logs that I can look at? like when you run
osqueryd
as a process i can add
--verbose
flag and see tons of logs on console screen. Where did these logs go when I run it as a service?
zwass

zwass

10/20/2020, 4:55 PM
IIRC windows services don't really provide a good mechanism for debugging.
5:07 PM
Is the service in a running state? Did you give the correct absolute path to the flagfile?
k

koba

10/20/2020, 5:24 PM
Yes. The service is running. And yes providing the absolute path as well. I am suspecting there might be some issue with using quote around the path at certain places. (Did some search on previous posts in this channel) For ex: I was earlier using double quotes for
--tls_server_certs
it certificate validation was failing. Removed rhe double quotes and it worked fine. But for
--extentions_autoload
I had to use double quotes else
osqueryd
would print our a lot of incoherent output on the screen. So Right now I'm using one flag with double quotes and one without. I'm not sure if this is the right direction or I'm just going crazy.
zwass

zwass

10/20/2020, 5:51 PM
Are those flags in a flagfile or are you passing them directly to the invocation of osqueryd?
k

koba

10/21/2020, 1:30 AM
Everything in a flag file @zwass.
1:02 PM
So I tried few more things:- • Tried to capture packets using Wireshark...there was nothing. Complete silence. To reiterate, there's absolutely no issues when i run osqueryd as a process. The issue is only when i run it as a service. • I thought may be there's something wrong with the
manage-osqueryd.ps1
so I tried creating service using PS. I then ran
Start-Service osqueryd
and it does nothing (service still remains in stopped stopped state). So i tried to start osqueryd via windows service console directly and it fails with 1067 error code. Putting it here just in case if it rings some bells...somewhere 😐