Hello everybody Sorry when I installed the fleet osquery msi

Question

Hello everybody Sorry when I installed the fleet osquery msi I started to get results like 400 157 on my Nginx Log Could anyone please help me get through this

Kathy Satterlee · Answer

Hi < Reza Kazemy> Can you share the full error you re seeing as well as any corresponding errors in your Fleet server Logs

Reza Kazemy · Answer

< Kathy Satterlee> Thank you for the reply Sure The fleet server container does not show any errors the version is 4 20 1 the agent that I am using had been generated with fleetctl version 4 20 1 the log of Nginx for fleet after installing the agent ``` GET api latest fleet device 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 desktop HTTP 1 1 400 157 ``` and here are my fleet container logs ```fleet webgui | hostID 1 level error message distributed query is denylisted query fleet detail query software windows ts 2022 12 07T07 24 36 580582109Z fleet webgui | err failed level error op directIngestSoftware ts 2022 12 07T07 24 36 582251321Z fleet webgui | component http err Authentication required internal authentication error invalid orbit node key level info path api fleet orbit config ts 2022 12 07T07 24 37 05854835Z fleet webgui | component http err Authentication required internal authentication error invalid orbit node key level info path api fleet orbit config ts 2022 12 07T07 25 07 122905616Z fleet webgui | component http err Authentication required internal authentication error invalid orbit node key level info path api fleet orbit config ts 2022 12 07T07 25 37 177454183Z ```

Reza Kazemy · Answer

< Kathy Satterlee> Hi Kathy I am so sorry did you get anything from the error code

Reza Kazemy · Answer

< Kathy Satterlee> Hi Katy I am so sorry for posting this question a lot I am kind of in an emergency situation I need to handle this error as soon az it possible Did you find anything that can help me with this error

Kathy Satterlee · Answer

So sorry < Reza Kazemy> It looks like the issue is related to your host not getting a valid token from Fleet Can you check the Fleet desktop and Orbit logs on on your host for any errors Orbit logs Fleet Desktop logs And make sure these endpoints aren t restricted in `nginx`

Reza Kazemy · Answer

< Kathy Satterlee> Thank you so much The strange things that happened on my device when I am using the agent software is that the UUID that is needed for desktop API first log and I have no idea what is happening on that proccess

Reza Kazemy · Answer

< Kathy Satterlee> Here is wat I had got from orbit logs `2022 12 17T14 57 43+03 30 INF calling flags update` `I1217 14 57 44 026043 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 18` `I1217 14 57 44 740763 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 13` `I1217 14 57 45 325450 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 23` `I1217 14 57 45 979974 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 2` `I1217 14 57 46 479738 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 21` `I1217 14 57 47 643726 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 17` `I1217 14 57 48 661547 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 1` `I1217 14 57 49 016599 15508 interfaces cpp 130 Failed to retrieve physical state for interface 1` `I1217 14 57 49 088176 15508 interfaces cpp 157 Failed to retrieve DHCP and DNS information for interface 1` `I1217 14 57 49 106617 15508 interfaces cpp 102 Failed to retrieve network statistics for interface 28` `I1217 14 57 49 261628 15508 interfaces cpp 130 Failed to retrieve physical state for interface 28` `I1217 14 57 49 291086 15508 interfaces cpp 157 Failed to retrieve DHCP and DNS information for interface 28` `2022 12 17T14 58 13+03 30 INF calling flags update` `2022 12 17T14 58 43+03 30 INF calling flags update` `2022 12 17T14 59 13+03 30 INF calling flags update`

Reza Kazemy · Answer

< Lucas Rodriguez> Sorry Lucas can you help me with this one as well

Kathy Satterlee · Answer

Reaching out to the team now Did you have Fleet Desktop logs as well

Reza Kazemy · Answer

Hi Kathy ```2022 12 19T14 06 50+03 30 DBG successfully refetched the token from disk 2022 12 19T14 06 50+03 30 ERR get device URL error= GET api latest fleet device x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 desktop received status 400 unknown 2022 12 19T14 06 55+03 30 DBG successfully refetched the token from disk 2022 12 19T14 06 55+03 30 ERR get device URL error= GET api latest fleet device x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 desktop received status 400 unknown 2022 12 19T14 07 00+03 30 DBG successfully refetched the token from disk 2022 12 19T14 07 00+03 30 ERR get device URL error= GET api latest fleet device x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 desktop received status 400 unknown 2022 12 19T14 07 05+03 30 DBG successfully refetched the token from disk 2022 12 19T14 07 05+03 30 ERR get device URL error= GET api latest fleet device x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 desktop received status 400 unknown 2022 12 19T14 07 10+03 30 DBG successfully refetched the token from disk 2022 12 19T14 07 10+03 30 ERR get device URL error= GET api latest fleet device x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 x00 desktop received status 400 unknown 2022 12 19T14 07 13+03 30 INF Shutdown was requested ``` this is the only thing I had got from the log file Thank you so much < Kathy Satterlee>

Lucas Rodriguez · Answer

Hi < Reza Kazemy> Couple of questions 1 This is a Windows host having the issues What version 2 Can you check the contents of `C Program Files Orbit identifier` Open with notepad we don t need the contents but just to know if it has a UUID something like `8bde4838 3f98 48a5 a60a 9a8699465564` 3 Can you attach more Orbit logs so we can take a look `C Windows System32 config systemprofile AppData Local FleetDM Orbit Logs orbit osquery log`

Lucas Rodriguez · Answer

4 What s the Orbit version In `cmd` ``` C Program Files Orbit bin orbit orbit exe version orbit 1 4 0```

Reza Kazemy · Answer

< Lucas Rodriguez> Sure Yes this is Windows 11 I checked the identifier file and it is empty disappointed I checked the path on my file system for orbit there is no orbit exe on my device to find out the version However I checked the orbit node key on my system and It does exist but cannot be loaded either I used fleetctl V4 24 0 in order to generate the software Thank you so much if you need anything else please let me know ```2022 12 19T13 16 24+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 16 54+03 30 INF calling flags update 2022 12 19T13 16 56+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 17 26+03 30 INF calling flags update 2022 12 19T13 17 28+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 17 58+03 30 INF calling flags update 2022 12 19T13 18 00+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 18 30+03 30 INF calling flags update 2022 12 19T13 18 32+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 19 02+03 30 INF calling flags update 2022 12 19T13 19 04+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 19 34+03 30 INF calling flags update 2022 12 19T13 19 36+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 20 06+03 30 INF calling flags update 2022 12 19T13 20 08+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 20 38+03 30 INF calling flags update 2022 12 19T13 20 40+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 21 06+03 30 ERR pinging the server error= HEAD api fleet orbit ping Head dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 21 10+03 30 INF calling flags update 2022 12 19T13 21 13+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 21 43+03 30 INF calling flags update 2022 12 19T13 21 45+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 22 15+03 30 INF calling flags update 2022 12 19T13 22 17+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 22 47+03 30 INF calling flags update 2022 12 19T13 22 49+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 23 19+03 30 INF calling flags update 2022 12 19T13 23 21+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 23 51+03 30 INF calling flags update 2022 12 19T13 23 53+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 24 23+03 30 INF calling flags update 2022 12 19T13 24 25+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 24 55+03 30 INF calling flags update 2022 12 19T13 24 57+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 25 27+03 30 INF calling flags update 2022 12 19T13 25 29+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 25 59+03 30 INF calling flags update 2022 12 19T13 26 01+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 26 06+03 30 ERR pinging the server error= HEAD api fleet orbit ping Head dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 26 31+03 30 INF calling flags update 2022 12 19T13 26 33+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 27 03+03 30 INF calling flags update 2022 12 19T13 27 05+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 27 35+03 30 INF calling flags update 2022 12 19T13 27 37+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 28 07+03 30 INF calling flags update 2022 12 19T13 28 09+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 28 39+03 30 INF calling flags update 2022 12 19T13 28 41+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 29 11+03 30 INF calling flags update 2022 12 19T13 29 13+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 29 43+03 30 INF calling flags update 2022 12 19T13 29 45+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 30 15+03 30 INF calling flags update 2022 12 19T13 30 17+03 30 INF flags updates failed error= error getting flags from fleet POST api fleet orbit config Post dial tcp 127 0 0 1 8443 connectex No connection could be made because the target machine actively refused it 2022 12 19T13 30 47+03 30 INF calling flags update 2022 12 19T13 30 47+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found W1219 13 31 08 553850 7180 options cpp 106 The CLI only flag logger plugin set via config file will be ignored please use a flagfile or pass it to the process at startup I1219 13 31 10 873294 7180 config cpp 908 Calling configure for logger tls I1219 13 31 10 873294 7180 config cpp 908 Calling configure for logger filesystem 2022 12 19T13 31 17+03 30 INF calling flags update 2022 12 19T13 31 17+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found 2022 12 19T13 31 47+03 30 INF calling flags update 2022 12 19T13 31 47+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found 2022 12 19T13 32 17+03 30 INF calling flags update 2022 12 19T13 32 17+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found 2022 12 19T13 32 47+03 30 INF calling flags update 2022 12 19T13 32 48+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found 2022 12 19T13 33 18+03 30 INF calling flags update 2022 12 19T13 33 18+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found ```

Reza Kazemy · Answer

I had to mention that I am using WSL Ubuntu in order to generate the software because I am using Linux env for my development tasks I am curious if it is going to cause any problems or not < Lucas Rodriguez>

Lucas Rodriguez · Answer

gt I had to mention that I am using WSL Ubuntu in order to generate the software because I am using Linux env for my development tasks gt I am curious if it is going to cause any problems or not Should not cause any issues gt 2022 12 19T13 33 18+03 30 INF flags updates failed error= error getting flags from fleet The resource was not found This is expected because your Fleet server version does not support this feature was added in <https github com fleetdm fleet releases tag fleet v4 21 0|4 21 0> gt Sorry when I installed the fleet osquery msi I started to get results like 400 157 on my Nginx Log So related to the above log these 400s are expected and should go away if you upgrade to 4 21 0 or higher However gt I checked the identifier file and it is empty This one is unexpected should not be empty

Reza Kazemy · Answer

< Lucas Rodriguez> < Kathy Satterlee> Thank you for your help I changed the version of the Fleetctl and fleet docker image to 4 21 0 and I deleted all the files which had been generated before for osquery and orbit on my file system Now I am getting a valid identifier for my desktop and steel I cannot Open the fleet desktop tab on my browser because the keeps showing connecting on my taskbar

Reza Kazemy · Answer

```2022 12 21T11 28 05+03 30 INF calling flags update 2022 12 21T11 28 35+03 30 INF calling flags update 2022 12 21T11 29 05+03 30 INF calling flags update 2022 12 21T11 29 35+03 30 INF calling flags update 2022 12 21T11 30 05+03 30 INF calling flags update 2022 12 21T11 30 26+03 30 INF orbit endpoints capability changed restarting 2022 12 21T11 30 31+03 30 INF running with auto updates disabled 2022 12 21T11 30 31+03 30 INF Failed to connect to Fleet server Osquery connection may fail error= dial for validate verify certificate x509 certificate is not valid for any names but wanted to match 2022 12 21T11 30 31+03 30 INF killing any pre existing fleet desktop instances 2022 12 21T11 30 31+03 30 INF start osqueryd cmd= C Program Files Orbit bin osqueryd windows stable osqueryd exe pidfile=C Program Files Orbit osquery pid database path=C Program Files Orbit osquery db extensions socket= pipe orbit osquery extension logger path=C Program Files Orbit osquery log enroll secret env ENROLL SECRET host identifier=uuid tls hostname=localhost 60189 enroll tls endpoint= api v1 osquery enroll config plugin=tls config tls endpoint= api v1 osquery config config refresh=60 disable distributed=false distributed plugin=tls distributed tls max attempts=10 distributed tls read endpoint= api v1 osquery distributed read distributed tls write endpoint= api v1 osquery distributed write logger plugin=tls filesystem logger tls endpoint= api v1 osquery log disable carver=false carver disable function=false carver start endpoint= api v1 osquery carve begin carver continue endpoint= api v1 osquery carve block carver block size=2000000 tls server certs C Program Files Orbit proxy fleet crt force flagfile C Program Files Orbit osquery flags 2022 12 21T11 30 31+03 30 INF using insecure TLS proxy addr=localhost 60189 target= 2022 12 21T11 30 31+03 30 INF opening path= C Program Files Orbit bin desktop windows stable fleet desktop exe I1221 11 30 31 632803 16908 interface cpp 137 Registering extension com fleetdm orbit osquery extension v1 9283 version= sdk= I1221 11 30 35 637126 9452 eventfactory cpp 156 Event publisher not enabled ntfs event publisher NTFS event publisher disabled via configuration 2022 12 21T11 31 01+03 30 INF calling flags update 2022 12 21T11 31 31+03 30 INF calling flags update 2022 12 21T11 40 03+03 30 INF calling flags update 2022 12 21T11 40 33+03 30 INF calling flags update 2022 12 21T11 41 03+03 30 INF calling flags update 2022 12 21T11 41 33+03 30 INF calling flags update 2022 12 21T11 42 03+03 30 INF calling flags update 2022 12 21T11 42 33+03 30 INF calling flags update 2022 12 21T11 43 03+03 30 INF calling flags update 2022 12 21T11 43 33+03 30 INF calling flags update 2022 12 21T11 44 03+03 30 INF calling flags update 2022 12 21T11 44 33+03 30 INF calling flags update 2022 12 21T11 45 03+03 30 INF calling flags update 2022 12 21T11 45 33+03 30 INF calling flags update 2022 12 21T11 46 03+03 30 INF calling flags update``` < Kathy Satterlee> < Lucas Rodriguez> Here is orbit osquery logs

Lucas Rodriguez · Answer

gt Now I am getting a valid identifier for my desktop and steel I cannot Open the fleet desktop tab on my browser because the keeps showing connecting on my taskbar 1 What do you mean by valid identifier for my desktop 2 Now that you ve upgraded and restored please can you check ` LocalAppData Fleet fleet desktop log` contents again

Lucas Rodriguez · Answer

< Reza Kazemy> point up 2

Reza Kazemy · Answer

You had asked me for an identifier file content if it had a valid UUID and I said it is empty Now it has a valid UUID Sure ``` ERR get device URL error= unauthenticated or invalid token 2022 12 21T10 13 37+03 30 DBG successfully refetched the token from disk 2022 12 21T10 13 37+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 13 42+03 30 DBG successfully refetched the token from disk 2022 12 21T10 13 42+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 13 47+03 30 DBG successfully refetched the token from disk 2022 12 21T10 13 47+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 13 52+03 30 DBG successfully refetched the token from disk 2022 12 21T10 13 52+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 13 57+03 30 DBG successfully refetched the token from disk 2022 12 21T10 13 57+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 02+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 02+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 07+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 07+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 12+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 12+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 17+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 17+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 22+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 22+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 27+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 27+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 32+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 32+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 37+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 37+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 42+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 42+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 47+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 47+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 52+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 52+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 14 57+03 30 DBG successfully refetched the token from disk 2022 12 21T10 14 57+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 02+03 30 DBG successfully refetched the token from disk 2022 12 21T10 15 02+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 07+03 30 DBG successfully refetched the token from disk 2022 12 21T10 15 07+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 12+03 30 DBG successfully refetched the token from disk 2022 12 21T10 15 12+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 17+03 30 DBG successfully refetched the token from disk 2022 12 21T10 15 17+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 22+03 30 DBG successfully refetched the token from disk 2022 12 21T10 15 22+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 27+03 30 DBG successfully refetched the token from disk 2022 12 21T10 15 27+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 21T10 15 32+03 30 DBG successfully refetched the token from disk``` < Lucas Rodriguez>

Lucas Rodriguez · Answer

< Reza Kazemy> OK cool Sorry for the back and forth Now the request from Orbit is well formed but the server response seems to be invalid Does your deployment have a proxy server between Orbit and the Fleet Server Something like nginx

Reza Kazemy · Answer

< Lucas Rodriguez> No problem my friend actually I am using Nginx in order to redirect the requests to the fleet container between orbit and fleet server I do not think so However let me send you my Nginx configuration maybe it would help you ```server listen 443 ssl server name Increase POST body size client max body size 300M TLS ssl certificate etc nginx tls fleet crt ssl certificate key etc nginx tls fleet key ssl session timeout 10m ssl ciphers HIGH aNULL MD5 ssl prefer server ciphers on fleet web server location ~ proxy pass proxy read timeout 90 proxy connect timeout 90 proxy set header Host $host proxy set header X Real IP $remote addr proxy set header X Forwarded For $proxy add x forwarded for proxy set header Proxy proxy set header Upgrade $http upgrade proxy set header Connection $connection upgrade location ~ api v1 fleet grpc pass grpc set header Host $host grpc set header X Forwarded For $proxy add x forwarded for proxy buffering off location ~ api v1 osquery grpc pass grpc set header Host $host grpc set header X Forwarded For $proxy add x forwarded for proxy buffering off ```

Lucas Rodriguez · Answer

First let s try the following Go to your Fleet Desktop logs again Grab the most recent error log e g from your last error dump in this thread ```2022 12 21T10 15 27+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error ``` Then visit the following URL in your browser ```https lt YOUR FLEET ADDRESS HERE gt api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop``` And let s see what we get

Lucas Rodriguez · Answer

The token rotates hence do not use the URL above you ll need to check the logs again and grab the latest error ^

Lucas Rodriguez · Answer

From looking at your nginx config you will need to add an entry for `~ api latest fleet` too you are adding it for `location ~ api v1 fleet `

Reza Kazemy · Answer

< Lucas Rodriguez> Here is the error that you had asked sure let me try adding this location path as well I will tell you the result Thank you so much for you help ```2022 12 22T14 20 27+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error ```

Reza Kazemy · Answer

< Lucas Rodriguez> I added the location path as you said However it is still not woriking the latest error ```2022 12 22T14 25 07+03 30 DBG successfully refetched the token from disk 2022 12 22T14 25 07+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error 2022 12 22T14 25 12+03 30 DBG successfully refetched the token from disk 2022 12 22T14 25 12+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error ```

Lucas Rodriguez · Answer

OK try visiting `https lt FLEET SERVER gt api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop` on your browser to check if your configuration is working

Lucas Rodriguez · Answer

< Reza Kazemy> point up 2

Reza Kazemy · Answer

Hi < Lucas Rodriguez> Sorry It has the same error as before I even tried to change the request protocol from grpc to http but it is not working again the error says there is something wrong with the JSON response How could it happen all the versions are matched and nothing is wrong with my request now because I have 200 response codes in my Nginx logs see ```fleet nginx | 172 23 0 1 25 Dec 2022 09 15 50 +0000 POST api v1 osquery distributed read HTTP 1 1 200 64 osquery 5 6 0 fleet nginx | 172 23 0 1 25 Dec 2022 09 15 51 +0000 POST api fleet orbit config HTTP 1 1 200 3 Go http client 1 1 fleet nginx | 172 23 0 1 25 Dec 2022 09 15 55 +0000 GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop HTTP 1 1 200 18 Go http client 1 1 ```

Reza Kazemy · Answer

the response of `https lt FLEET SERVER gt api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop` is error is it expected for the status 200 response code < Lucas Rodriguez>

Lucas Rodriguez · Answer

Hi < Reza Kazemy> You are now seeing a bug of 4 22 0 that was fixed in see the Can you upgrade and try again

Reza Kazemy · Answer

sure I will upgrade the version and inform you about the result < Lucas Rodriguez>

Reza Kazemy · Answer

< Lucas Rodriguez> Hi my friend I still had the same error as before ```2022 12 22T14 25 12+03 30 ERR get device URL error= decode GET api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop response json cannot unmarshal object into Go struct field fleetDesktopResponse error of type error ``` I upgraded everything

Reza Kazemy · Answer

when I entered `https lt FLEET SERVER gt api latest fleet device 64a0baf1 2409 4e2c a98b 9f9ae1a8256d desktop` the response would be `error ` Is it expected

Lucas Rodriguez · Answer

Hi < Reza Kazemy> OK can you double check Fleet s version ```curl https lt YOUR FLEET ADDRESS gt version```

Reza Kazemy · Answer

< Lucas Rodriguez> I cannot thank you enough Unfortunately I had forgotten to change one of my ENV variables to complete the upgrade steps Now I am running fleet on version v 4 22 1 as you said and everything is working on my local device Thank you so much