Unknown Problem

[Acewiza]

Has anybody else been seeing alot more "Unknown Problem Somewhere In The System" since the last update?

[dougburks]

Have you drilled into the alerts to see the exact log that caused the alert?

Is it possible that the logs you're seeing are just for the update process itself?

[Acewiza]

Log count rising again, maybe burped something the past few days. Let's forget about that little misdirection, for now.

[Acewiza]

Lotsa table finding issues.

Feb 15 16:13:22 onion2 launcher[794]: {"caller":"distributed.cpp:144","component":"osquery","level":"stderr","msg":"E0215 16:13:22.070667 1271 distributed.cpp:144] Error executing distributed query: fleet_detail_query_google_chrome_profiles: no such table: google_chrome_profiles","severity":"info","ts":"2022-02-15T16:13:22.070765441Z"}

[defensivedepth]

These types of logs can be ignored at this point.

[dougburks]

If necessary, you could tune your Wazuh ruleset to avoid firing an alert on these nuisance logs:
https://docs.securityonion.net/en/2.3/wazuh.html#tuning-rules

[Acewiza]

Nuisance logs! I knew there had to be some explanation. I'm sure you guys have more important logs to worry about -thanks! ;-)

[Acewiza]

I believe so, I mean so-status reports all OK, and like I said, no other real indication anything is broken.

…

On Tue, Feb 15, 2022 at 4:52 AM Doug Burks ***@***.***> wrote: Feb 13 13:20:36 onion2 launcher[717]: {"caller":"distributed.cpp:144","component":"osquery","level":"stderr","msg":"E0213 13:20:36.533423 1214 distributed.cpp:144] Error executing distributed query: fleet_detail_query_munki_info: no such table: munki_info","severity":"info","ts":"2022-02-13T13:20:36.533447029Z"} Feb 14 14:34:58 onion2 launcher[717]: {"caller":"query_target.go:75","err":"fetching target memberships: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: INTERNAL_ERROR","msg":"updating kolide_target_membership data","severity":"error","ts":"2022-02-14T14:34:58.958147065Z"} Both of these logs appear to be related to Fleet/osquery. Are these services working correctly for you? — Reply to this email directly, view it on GitHub <#7184 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASJEPQQHVZCN4MPZBKGJXDLU3I463ANCNFSM5OETNFQA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/7184/comments/2180370 @github.com>

-- Paul D. Shaffer, MSgt, USAF (ret.)