Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide more information in the logs when distributed TLS requests fail #8322

Open
lucasmrod opened this issue Apr 30, 2024 · 0 comments
Open

Comments

@lucasmrod
Copy link
Contributor

Bug report

What version of osquery are you using?

osquery 5.12.1

Currently, if distributed TLS requests to --distributed_tls_read_endpoint and --distributed_tls_write_endpoint fail on the TCP/IP or TLS layer, or if the JSON in the response could not be parsed, osquery shows nothing and retries (even when running with --verbose).

E.g. if osquery is configured with --distributed_tls_max_attempts=3 and the server is down or not returning a JSON response you just get:

265887 I0430 11:55:03.687932 29520 tls.cpp:263] TLS/HTTPS POST request to URI: https://example.com/api/v1/osquery/distributed/write
265891 I0430 11:55:05.651844 29520 tls.cpp:263] TLS/HTTPS POST request to URI: https://example.com/api/v1/osquery/distributed/write
265892 I0430 11:55:10.595957 29520 tls.cpp:263] TLS/HTTPS POST request to URI: https://example.com/api/v1/osquery/distributed/write

Which does not help for troubleshooting.

We should add some error logs when running with --verbose.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant