Mikhail
12/29/2022, 1:44 PMLucas Rodriguez
12/29/2022, 2:50 PMflagfile
are you referring to? Are you assembling `flagfile`s manually for hosts running osquery?
3. Can you share the logs that show the error? Also what's your Agent Settings/Options in the Fleet UI (particularly the field logger_tls_endpoint
).Mikhail
12/29/2022, 3:12 PM--enroll_secret_path=C:\Program Files\osquery\enroll_secret
--tls_hostname=my.server:8081
--pidfile=C:\Program Files\osquery\osqueryd.pidfile
--host_identifier=uuid
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=60
--disable_distributed=false
--disable_events=true
--disable_extensions=true
--disable_tables=curl
--distributed_plugin=tls
--distributed_interval=60
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
--watchdog_memory_limit=400
--watchdog_utilization_limit=150
and log snippet after queries distributing say this:
I1229 16:05:17.613806 17656 tls.cpp:255] TLS/HTTPS POST request to URI: <https://my.server:8081/api/osquery/log>
I1229 16:05:17.936024 17656 buffered.cpp:90] Error sending status to logger: Cannot parse JSON: Invalid value. Offset: 0
Lucas Rodriguez
12/29/2022, 3:21 PMlogger_tls_endpoint
.Mikhail
12/29/2022, 4:09 PMMessage:
config:
options:
logger_plugin: tls
disable_tables: windows_events
pack_delimiter: /
logger_tls_period: 10
distributed_plugin: tls
disable_distributed: false
logger_tls_endpoint: /api/osquery/log
distributed_interval: 10
schedule_splay_percent: 10
logger_snapshot_event_type: true
distributed_tls_max_attempts: 3
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
file_paths:
efi:
- /System/Library/CoreServices/boot.efi
binaries:
- /usr/bin/%%
- /usr/sbin/%%
- /bin/%%
- /sbin/%%
- /usr/local/bin/%%
- /usr/local/sbin/%%
- /opt/bin/%%
- /opt/sbin/%%
configuration:
- /etc/%%
command_line_flags: {} # requires Fleet's osquery installer
Actually, due to errors info, logs come to /api/v1/osquery/log, but fleet config uses /api/osquery/log - it's very strange. Maybe config changed after server update somehow or it's impossible?Lucas Rodriguez
12/29/2022, 4:12 PMMaybe config changed after server update somehow or it's impossible?Maybe? Am not sure either.
logger_tls_endpointAmend, save settings and hosts should eventually start using the correct path. Makes sense?
Mikhail
12/29/2022, 4:42 PMCould not update settings. unsupported key provided: "logger_plugin"
Trying to make new config.yaml, but getting error
Error: no spec field on "" document
roberto
12/29/2022, 5:19 PMlogger_plugin
from the settings as it's not a valid key anymore and it's safe to removeMikhail
12/29/2022, 5:43 PM