Shend Saliaga
01/17/2023, 9:04 PM"level=error ts=2023-01-17T20:52:34.232573858Z component=http method=POST uri=/api/v1/osquery/distributed/write took=419.259117ms ip_addr=74.122.186.196 x_for_ip_addr="74.122.186.196, 35.201.103.38" ingestion-err="ingesting query users: update host users: insert users: Error 1390: Prepared statement contains too many placeholders" err="error in query ingestion"
"
Have seen a mention here in #kolide: https://osquery.slack.com/archives/C1XCLA5DZ/p1531260258000023
Currently running fleetdm/fleet:v4.25.0
with ~900 hostszwass
Shend Saliaga
01/18/2023, 2:05 AM~/Development/infosec-fleet-kubernetes master kubectl logs job.batch/fleet-prepare-db -c fleet -n fleet
Migrations already completed. Nothing to do.
Kathy Satterlee
01/18/2023, 8:32 PMSELECT name, value FROM osquery_flags WHERE name = "logger_plugin" ;
Shend Saliaga
01/18/2023, 8:38 PMconfig_plugin
to configure tls?
--logger_stderr=false
--logger_min_status=1
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=1800
--watchdog_level=0
--watchdog_memory_limit=1024
--watchdog_delay=3600
--logger_plugin=name
Kathy Satterlee
01/18/2023, 8:57 PMShend Saliaga
01/18/2023, 8:58 PM~/Development/infosec-fleet-kubernetes/staging master * sudo fleetctl apply -f fleet_org.yml
Warning: Version mismatch.
Client Version: 4.24.0
Server Version: 4.25.0
Error: applying fleet config: PATCH /api/latest/fleet/config received status 400 Bad Request: unsupported key provided: "logger_mode"
~/Development/infosec-fleet-kubernetes/staging master * sudo fleetctl apply -f fleet_org.yml
Warning: Version mismatch.
Client Version: 4.24.0
Server Version: 4.25.0
Error: applying fleet config: PATCH /api/latest/fleet/config received status 400 Bad Request: unsupported key provided: "logger_mode"
~/Development/infosec-fleet-kubernetes/staging master * V
~/Development/infosec-fleet-kubernetes/staging master * vi fleet_org.yml
~/Development/infosec-fleet-kubernetes/staging master * sudo fleetctl apply -f fleet_org.yml
Warning: Version mismatch.
Client Version: 4.24.0
Server Version: 4.25.0
Error: applying fleet config: PATCH /api/latest/fleet/config received status 400 Bad Request: unsupported key provided: "logger_plugin"
~/Development/infosec-fleet-kubernetes/staging master * vi fleet_org.yml
~/Development/infosec-fleet-kubernetes/staging master * sudo fleetctl apply -f fleet_org.yml
Warning: Version mismatch.
Client Version: 4.24.0
Server Version: 4.25.0
Error: applying fleet config: PATCH /api/latest/fleet/config received status 400 Bad Request: unsupported key provided: "utc"
logger_mode
, logger_plugin
, utc
Kathy Satterlee
01/18/2023, 8:59 PMShend Saliaga
01/18/2023, 8:59 PM