Gudina
02/09/2023, 6:28 PMI0208 17:44:39.302111 254910464 buffered.cpp:75] Error sending results to logger: Cannot parse JSON: The document root must not be followed by other values. Offset: 4
Kathy Satterlee
02/09/2023, 6:36 PMGudina
02/09/2023, 6:46 PM--verbose=true
--disable_events=false
--disable_audit =false
--enable_monitor=true
--audit_allow_config=true
--audit_allow_sockets=true
--disable_endpointsecurity=false
--worker_threads=2
--tls_hostname=<server>:443
--tls_server_certs=/private/var/osquery/cert_bundle.crt
--enroll_secret_path=/private/var/osquery/fleet_secret
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=10
--disable_distributed=false
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=filesystem
--logger_tls_endpoint=/api/v1/osquery/log
--logger_path=/var/log/osquery
Kathy Satterlee
02/09/2023, 6:51 PMosqueryd.results.archive.log
Gudina
02/09/2023, 6:58 PMlogger_plugin=tls
. I changed it to logger_plugin=filesystem
for testing.Kathy Satterlee
02/09/2023, 7:00 PMGudina
02/09/2023, 7:00 PM/var/log/osquery/osqueryd.results.log
logger_plugin=filesystem
Kathy Satterlee
02/09/2023, 7:01 PMGudina
02/09/2023, 7:02 PMKathy Satterlee
02/09/2023, 7:02 PMGudina
02/09/2023, 7:03 PMzwass
--verbose --tls_dump
to your osquery flagfile and then seeing what Fleet returns for that log request?Gudina
02/09/2023, 7:15 PMcan not parse JSON
issue. On the agent, I have --logger_tls_endpoint=/api/v1/osquery/log
and on Fleet Osquery options logger_tls_endpoint: /api/osquery/log
zwass
/api/osquery/*
for all the osquery endpoints -- you could try removing the v1
from your flagfile.Gudina
02/09/2023, 7:39 PMzwass
api/osquery/log
Gudina
02/10/2023, 1:32 AMI0209 17:31:18.297050 1850322944 http_client.cpp:420] HTTP(S) request re-directed to: /api/v1/osquery/api/osquery/log
I0209 17:31:18.370936 1850322944 buffered.cpp:90] Error sending status to logger: Cannot parse JSON: The document root must not be followed by other values. Offset: 4
zwass
Gudina
02/10/2023, 1:39 AMzwass
Gudina
02/10/2023, 1:41 AMzwass
Gudina
02/10/2023, 1:42 AMzwass
--tls_dump
turned on? You should be able to see the JSON responseGudina
02/10/2023, 1:44 AMzwass
Gudina
02/10/2023, 1:46 AMosqueryd --flagfile=/private/var/osquery/osquery.flags
I0209 174834.201555 1871458304 http_client.cpp:420] HTTP(S) request re-directed to: /api/v1/osquery/api/osquery/log
404 page not foundzwass
Gudina
02/10/2023, 1:55 AMzwass