• k

    Karthick

    3 weeks ago
    Hi, Osquery software page doesn't load but am able to view the software and Vulnerable software from the host. Osquery is hosted in Kubernetes and version 4.11.0
  • Kathy Satterlee

    Kathy Satterlee

    3 weeks ago
    Hi, @Karthick! Are you seeing anything in the console or network requests?
  • k

    Karthick

    3 weeks ago
    console error
  • i tried /api/v1/fleet/software from postman even that remain in message sending request but no response but am able to query other api endpoints like config
  • in pod logs i could see {"err":"failed","level":"error","op":"directIngestSoftware","ts":"2022-07-19T16:52:32.35786363Z"}
  • Kathy Satterlee

    Kathy Satterlee

    3 weeks ago
    Do you get the same error if you try in another browser or an incognito window?
  • I see you tried it in Postman, but I'm still curious about incognito.
  • And did this just suddenly stop working, or was there a recent change?
  • k

    Karthick

    3 weeks ago
    it was not working from the time it is deployed and tried in a different browser and incognito same result
  • Kathy Satterlee

    Kathy Satterlee

    3 weeks ago
    Thanks for that info. Looking into this to see what the culprit might be.
  • Can you run
    fleetctl debug errors
    and see if there's any additional info there? If you'd be up for scanning that file for any sensitive data you'd like to remove and sharing it, that would be awesome as well.
  • k

    Karthick

    3 weeks ago
    in debug json file all i can see it multiple entry of {"external": "enroll failed: timestamp: 2022-07-21T08:07:15Z: no matching secret found" },
  • osquery is running in k8s so installed fleetctl in linux and executed fleetctl debug errors command
  • Kathy Satterlee

    Kathy Satterlee

    3 weeks ago
    This may be related to an issue we're tracking. Do you have any Ubuntu hosts enrolled?
  • k

    Karthick

    3 weeks ago
    we have centos, mac, windows
  • @Kathy Satterlee the version referred in issue is v4.17 and ubuntu host in my case we are running with v4.11. So, v4.11 also has this bug ?
  • Kathy Satterlee

    Kathy Satterlee

    3 weeks ago
    I apologize, I must have misread the version! Given that there aren't any errors in the Fleet logs or the pod logs, it seems likely that the error is popping up somewhere between Fleet and you. When you checked the logs in Kubernetes, did you also look at the logs for your load balancer or proxy server?