osquery agent connection fails

[011248163264]

Hi to all, here is my setup
so-server on 192.168.1.95
one server with osquery agent on 192.168.1.152
there is no firewall between only so-allow
the agent osquery --tls_hostname=192.168.1.95:8080
i open the port with so-allow and option o, but is 8090/tcp
how can i register the osquery on the server ?
It runs in a time out !
i have changed the fleet web url to https://192.168.1.95:8080 it was only on localhost

[defensivedepth]

hey there!

Can you please send me the following output (sanitized as needed):

From the Manager:

sudo salt-call pillar.get global

sudo cat /opt/so/saltstack/local/salt/fleet/packages/launcher.flags

[011248163264]

thats my output from the console:

/usr/local/so-launcher/bin/osqueryd --flagfile=flagfile.txt --verbose

I1202 21:47:49.710788 27174 init.cpp:340] osquery initialized [version=4.5.1]
I1202 21:47:49.740676 27174 system.cpp:342] Found stale process for osqueryd (6778)
I1202 21:47:49.740763 27174 system.cpp:374] Writing osqueryd pid (27174) to /var/run/osqueryd.pidfile
I1202 21:47:49.740890 27174 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load
I1202 21:47:49.740986 27174 dispatcher.cpp:78] Adding new service: WatcherRunner (0x555f093c1a88) to thread: 140246085117696 (0x555f09220480) in process 27174
I1202 21:47:49.742223 27175 watcher.cpp:613] osqueryd watcher (27174) executing worker (27176)
I1202 21:47:49.758445 27176 init.cpp:337] osquery worker initialized [watcher=27174]
I1202 21:47:49.758674 27176 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (0x558c7a51c8e8) to thread: 139887778604800 (0x558c7a524850) in process 27176
I1202 21:47:49.758807 27176 rocksdb.cpp:132] Opening RocksDB handle: /var/osquery/osquery.db
I1202 21:47:49.792068 27176 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0x558c7a6853f8) to thread: 139887736641280 (0x558c7a51b900) in process 27176
I1202 21:47:49.792207 27176 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0x558c7a694d28) to thread: 139887728248576 (0x558c7a518430) in process 27176
I1202 21:47:49.792308 27176 tls_enroll.cpp:70] TLSEnrollPlugin requesting a node enroll key from: https://192.168.1.95:8080/api/v1/osquery/enroll
I1202 21:47:49.792481 27183 interface.cpp:270] Extension manager service starting: /var/osquery/osquery.em
I1202 21:47:49.792990 27176 system.cpp:301] Using host identifier: e473b2e0-9728-4194-8f52-d7ba8bc46fad
I1202 21:47:49.793939 27176 smbios_tables.cpp:105] Reading SMBIOS from sysfs DMI node
I1202 21:47:49.795293 27176 smbios_tables.cpp:105] Reading SMBIOS from sysfs DMI node
I1202 21:47:49.796545 27176 tls.cpp:254] TLS/HTTPS POST request to URI: https://192.168.1.95:8080/api/v1/osquery/enroll
W1202 21:48:05.797780 27176 tls_enroll.cpp:77] Failed enrollment request to https://192.168.1.95:8080/api/v1/osquery/enroll (Request error: Failed to connect to 192.168.1.95:8080: Connection timed out) retrying...

[011248163264]

are there any idea's

[defensivedepth]

The console output says it is trying to connect to 192.168.1.95:8080

As you can see from the launcher.flags file, it should be 8090. Was the launcher.flags file edited? If so, change it back to match /opt/so/saltstack/local/salt/fleet/packages/launcher.flags, then rerun it and post the console output

[011248163264]

here is the output:

/usr/local/so-launcher/bin/osqueryd --flagfile=flagfile.txt --verbose

I1206 20:05:36.726060 27969 init.cpp:340] osquery initialized [version=4.5.1]
I1206 20:05:36.788791 27969 system.cpp:342] Found stale process for osqueryd (27174)
I1206 20:05:36.788942 27969 system.cpp:374] Writing osqueryd pid (27969) to /var/run/osqueryd.pidfile
I1206 20:05:36.789170 27969 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load
I1206 20:05:36.789400 27969 dispatcher.cpp:78] Adding new service: WatcherRunner (0x55f65a1d8a88) to thread: 139986708768512 (0x55f65a037480) in process 27969
I1206 20:05:36.791843 27970 watcher.cpp:613] osqueryd watcher (27969) executing worker (27971)
I1206 20:05:36.826756 27971 init.cpp:337] osquery worker initialized [watcher=27969]
I1206 20:05:36.827113 27971 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (0x55c6a98388e8) to thread: 139742672135936 (0x55c6a9840850) in process 27971
I1206 20:05:36.827374 27971 rocksdb.cpp:132] Opening RocksDB handle: /var/osquery/osquery.db
I1206 20:05:36.867482 27971 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0x55c6a99c57d8) to thread: 139742630172416 (0x55c6a9837900) in process 27971
I1206 20:05:36.867751 27971 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0x55c6a99ade78) to thread: 139742621779712 (0x55c6a9834430) in process 27971
I1206 20:05:36.867923 27971 tls_enroll.cpp:70] TLSEnrollPlugin requesting a node enroll key from: https://192.168.1.95:8090/api/v1/osquery/enroll
I1206 20:05:36.868060 27978 interface.cpp:270] Extension manager service starting: /var/osquery/osquery.em
I1206 20:05:36.868465 27971 system.cpp:301] Using host identifier: e473b2e0-9728-4194-8f52-d7ba8bc46fad
I1206 20:05:36.870229 27971 smbios_tables.cpp:105] Reading SMBIOS from sysfs DMI node
I1206 20:05:36.873216 27971 smbios_tables.cpp:105] Reading SMBIOS from sysfs DMI node
I1206 20:05:36.874948 27971 tls.cpp:254] TLS/HTTPS POST request to URI: https://192.168.1.95:8090/api/v1/osquery/enroll
W1206 20:05:36.980856 27971 tls_enroll.cpp:77] Failed enrollment request to https://192.168.1.95:8090/api/v1/osquery/enroll (Request error: certificate verify failed) retrying...

[defensivedepth]

Looks like the cert is not verifying. Can you explain in more detail what this means?

i have changed the fleet web url to https://192.168.1.95:8080 it was only on localhost

[ebdavison]

I am having a similar issue. Can I piggy back on this or do I need to start a new discussion?

I have the same errors and this one was never resolved. I know what the OP meant as an answer to your last question as I have the same situation.