https://github.com/osquery/osquery logo
#fleet
Title
# fleet
j

Jincheng Yin

12/12/2022, 11:48 AM
Hi team, we are migrating our fleet server to a new project (GKE) with Terraform. But we counter a weird issue, the server just keep restarting. Can't find any warning/error in the log.
Copy code
level=info ts=2022-12-12T09:51:18.810646803Z component=redis mode=standalone                                                               
level=info ts=2022-12-12T09:51:18.819616955Z msg="GCP PubSub writer configured" project=awx-it-infrastructure topic=awx-fleet-osquery-statu
s add_attributes=false                                                                                                                     
level=info ts=2022-12-12T09:51:18.820644484Z msg="GCP PubSub writer configured" project=awx-it-infrastructure topic=awx-fleet-osquery-resul
t add_attributes=false                                                                                                                     
level=info ts=2022-12-12T09:51:19.500416806Z component=crons cron=vulnerabilities cron=vulnerabilities softwareinventory="not configured"  
level=info ts=2022-12-12T09:51:19.704020837Z msg="metrics endpoint disabled (http basic auth credentials not set)"                         
ts=2022-12-12T09:51:19.706150806Z transport=http address=0.0.0.0: msg=listening                                                            
ts=2022-12-12T09:51:45.503923208Z terminated="http: Server closed"
m

Michal Nicpon

12/12/2022, 11:52 AM
It’s possible that the fleet pod is getting killed by k8s. Can you check the pod status using
kubectl get pods …
and also the pod events using
kubectl describe pod …
j

Jincheng Yin

12/12/2022, 3:26 PM
@Michal Nicpon This is the info from the pod.
m

Michal Nicpon

12/12/2022, 3:35 PM
Are those all the events? it looks like the screen shot is cut off
How do you have your health check configured? Do you mind sharing your pod configuration?
j

Jincheng Yin

12/12/2022, 3:41 PM
Those are all the events. The project is currently managed by another team member, so I will check with him.