https://github.com/osquery/osquery logo
#fleet
Title
# fleet
t

Terje Kvernes

12/01/2022, 2:12 PM
Is there a way to avoid the noise of “Requires Fleet Premium license” in the logs for the proxy we have in front of fleet? We can theoretically have that specific URL log to /dev/null, but that sounds a bit horrible. 😛
r

Rachel Perkins

12/01/2022, 3:54 PM
Hi Terge! Can you give me an example of where you're seeing this noise so I can get a better sense of how we might be able to resolve it?
t

Terje Kvernes

12/01/2022, 5:49 PM
Ah, it’s not in the proxy logs, it’s in the systemd journal
Dec 01 18:45:19 … fleet[4055958]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"…,"level":"error","method":"GET","took":"789.948µs","ts":"2022-12-01T17:45:19.339897253Z","uri":"/api/latest/fleet/device/86721f52-cdc5-448f-9754-c8dbb089b2eb/desktop","x_for_ip_addr":"..."}
r

Rachel Perkins

12/01/2022, 6:01 PM
Thank you Terje (and sorry about my spelling earlier >.<) so if I'm understanding correctly, without a fleet premium account, you're running into fleet premium requirement errors hitting an API on the device page? Is there anywhere else you've identified seeing this noise? We definitely don't like unneeded noise like this returning.
t

Terje Kvernes

12/02/2022, 2:36 PM
We are seeing the errors in the linux journal log (via
journalctl
). We do not see this anywhere in the web interface. We also do not have a premium account but it seems that the client are trying to access a URI that requires a premium account.
And thank you for looking into this, apologies for the late reply!
g

Gregory Storme

12/12/2022, 12:23 PM
I'm also seeing this, has been going on for a while, just noticing it now. Same uri, have always used fleet without a license. Running fleet 4.24.1 and using orbit on the agents
3 Views