[GA] Fleet update fails to parse JSON on remote client.

[trb143]

Have a Virtual machine which was a 2.2 box and been migrated forward to the latest GA release.

Fleet client on a test laptop fails to work even though I have reinstalled the latest deb package.

Running /usr/local/so-launcher/bin/osqueryd --config_path=/etc/so-launcher/launcher.flags --verbose is the best way I can find any issues! Attached is the console output.

so.txt

How can this be fixed or debugged better.

Thanks

[defensivedepth]

What does the flags file contain?

cat /etc/so-launcher/launcher.flags

Can you confirm that the following files are not empty?

/etc/so-launcher/roots.pem
/etc/so-launcher/secret

[trb143]

/etc/so-launcher/roots.pem - Contains a certificate
/etc/so-launcher/secret - Contains a Hash

The attached file contains the cat output.

so1.txt

[defensivedepth]

Please try uninstalling the osquery package and deleting those config files (blow away /etc/so-launcher), then try installing the package from the latest deb file from the Manager.

[trb143]

Still the same. The laptop showing the error and checking the nginx access logs we are getting no traffic.

The output from so-allow-view

[root@securityonion nginx]# so-allow-view

Hosts/Networks that have access to login to the Security Onion Console:
127.0.0.1
192.168.20.0/24
[root@securityonion nginx]#

[defensivedepth]

Ok, so I didnt notice it before, but this is not going to work:

/usr/local/so-launcher/bin/osqueryd --config_path=/etc/so-launcher/launcher.flags --verbose

Because that flag file uses Launcher flags - Launcher is a wrapper we use for Osquery that allows auto-updates, etc.

Instead, please try launching osqueryd like this, and post the resultant logs:

From: /usr/local/so-launcher/

sudo /usr/local/so-launcher/bin/launcher -config /etc/so-launcher/launcher.flags --debug --osquery_verbose

[trb143]

Ok thanks.
It is now working but there may be an underlying issue still.
It was not working but this is the steps needed to get it working.

1. Stop Systemd launcher on client
2. Start Security Onion VM
3. Fleet does not see client
4. Run command line script
5. Fleet sees the client fine.
6. reboot client and login to fleet
7. client shows up in red.
8. Start and enable systemd launcher
9. client shows up in green
10. Reboot
11. Client shows up.

No idea why running the client from the command line got things working and running from systemd did not.

Thanks for the help!

[defensivedepth]

No problem!