Hi I keep hitting the following error ``` level=error ts=202

Question

Hi I keep hitting the following error ``` level=error ts=2023 01 17T20 52 34 232573858Z component=http method=POST uri= api v1 osquery distributed write took=419 259117ms ip addr=74 122 186 196 x for ip addr= 74 122 186 196 35 201 103 38 ingestion err= ingesting query users update host users insert users Error 1390 Prepared statement contains too many placeholders err= error in query ingestion ``` Have seen a mention here in < C1XCLA5DZ|kolide> Currently running `fleetdm fleet v4 25 0` with ~900 hosts

zwass · Answer

Have you double checked you ran all the DB migrations

Shend Saliaga · Answer

Just doubled checked and ran the migrations again

Shend Saliaga · Answer

```~ Development infosec fleet kubernetes master kubectl logs job batch fleet prepare db c fleet n fleet Migrations already completed Nothing to do ```

Shend Saliaga · Answer

Following up on this issue as this might be red herring The real problem im having is that after upgrading osquery from 5 2 2 to 5 7 our pubsub topic stopped receiving logs However all the agents were online and queryable through the UI after the update to 5 7 Reverting to 5 2 2 did not fix the issue either

Kathy Satterlee · Answer

Can you verify the logging configuration on your agents by running the following query through Fleet ```SELECT name value FROM osquery flags WHERE name = logger plugin ```

Shend Saliaga · Answer

image png

Shend Saliaga · Answer

should this be tls

Shend Saliaga · Answer

Looks like it is reverting for filesystem for all of our linux hosts

Shend Saliaga · Answer

Thanks Ill read into this

Shend Saliaga · Answer

Looks like we are using `config plugin` to configure tls ``` logger stderr=false logger min status=1 enroll tls endpoint= api v1 osquery enroll config plugin=tls config tls endpoint= api v1 osquery config config refresh=1800 watchdog level=0 watchdog memory limit=1024 watchdog delay=3600```

Shend Saliaga · Answer

Looks like it has changed to ` logger plugin=name`

Shend Saliaga · Answer

Where can I find deprecations like this I cant seem to find it in the release notes

Kathy Satterlee · Answer

You ll need to set that in your osquery flags I don t believe that the flag itself has changed but osquery itself has gotten a bit stricter about how and where command line flags can be set It sounds like you may have previously set that in your Fleet agent options is that right

Shend Saliaga · Answer

Correct I did notice that last night when pulling down my config

Shend Saliaga · Answer

```~ Development infosec fleet kubernetes staging master sudo fleetctl apply f fleet org yml Warning Version mismatch Client Version 4 24 0 Server Version 4 25 0 Error applying fleet config PATCH api latest fleet config received status 400 Bad Request unsupported key provided logger mode ~ Development infosec fleet kubernetes staging master sudo fleetctl apply f fleet org yml Warning Version mismatch Client Version 4 24 0 Server Version 4 25 0 Error applying fleet config PATCH api latest fleet config received status 400 Bad Request unsupported key provided logger mode ~ Development infosec fleet kubernetes staging master V ~ Development infosec fleet kubernetes staging master vi fleet org yml ~ Development infosec fleet kubernetes staging master sudo fleetctl apply f fleet org yml Warning Version mismatch Client Version 4 24 0 Server Version 4 25 0 Error applying fleet config PATCH api latest fleet config received status 400 Bad Request unsupported key provided logger plugin ~ Development infosec fleet kubernetes staging master vi fleet org yml ~ Development infosec fleet kubernetes staging master sudo fleetctl apply f fleet org yml Warning Version mismatch Client Version 4 24 0 Server Version 4 25 0 Error applying fleet config PATCH api latest fleet config received status 400 Bad Request unsupported key provided utc ```

Shend Saliaga · Answer

Had to delete these keys `logger mode` `logger plugin` `utc`

Kathy Satterlee · Answer

Here s the full flag list just to be safe <https fleetdm com docs using fleet adding hosts configure and launch osquery>

Shend Saliaga · Answer

Thanks Ill definitely review