koba
10/20/2020, 9:45 AMosqueryd.exe
as a process I am able to enroll my windows host. But when i configure a service
. Same host doesn't come online in my Kolide web console. I have also enabled Windows Event Log support
as described here. Event logs also doesn't show any entries. Where to look for further troubleshooting?
PS: I'm using manage-osqueryd.ps1
for configuring the my service.zwass
10/20/2020, 4:27 PMkoba
10/20/2020, 4:49 PMosqueryd
as a process i can add --verbose
flag and see tons of logs on console screen. Where did these logs go when I run it as a service?zwass
10/20/2020, 4:55 PMkoba
10/20/2020, 5:24 PM--tls_server_certs
it certificate validation was failing. Removed rhe double quotes and it worked fine. But for --extentions_autoload
I had to use double quotes else osqueryd
would print our a lot of incoherent output on the screen.
So Right now I'm using one flag with double quotes and one without. I'm not sure if this is the right direction or I'm just going crazy.zwass
10/20/2020, 5:51 PMkoba
10/21/2020, 1:30 AMmanage-osqueryd.ps1
so I tried creating service using PS. I then ran Start-Service osqueryd
and it does nothing (service still remains in stopped stopped state). So i tried to start osqueryd via windows service console directly and it fails with 1067 error code.
Putting it here just in case if it rings some bells...somewhere 😐