Last active
April 16, 2018 22:03
-
-
Save Jackbennett/e3260e954ad3d9f26e9a5e58660fb8d6 to your computer and use it in GitHub Desktop.
debugging TLS issue with osquery
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
osquery.flags -> | |
--enroll_secret_path=c:\programdata\osquery\heroku.secret | |
--tls_server_certs=c:\programdata\osquery\demoapponherokuapp.com.pem | |
--tls_hostname=demoapponherokuapp.com | |
--host_identifier=hostname | |
--enroll_tls_endpoint=/api/v1/osquery/enroll | |
--config_plugin=tls | |
--config_tls_endpoint=/api/v1/osquery/config | |
--config_tls_refresh=10 | |
--disable_distributed=false | |
--distributed_plugin=tls | |
--distributed_interval=10 | |
--distributed_tls_max_attempts=3 | |
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read | |
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write | |
--logger_plugin=tls | |
--logger_tls_endpoint=/api/v1/osquery/log | |
--logger_tls_period=10 | |
jbennett $ .\osqueryd\osqueryd.exe --verbose --tls_dump --flagfile .\osquery.flags | |
I0208 14:19:09.878975 2708 init.cpp:380] osquery initialized [version=2.11.2] | |
I0208 14:19:09.990751 2708 system.cpp:344] Found stale process for osqueryd (3604) | |
I0208 14:19:09.991757 2708 system.cpp:377] Writing osqueryd pid (3220) to \ProgramData\osquery\osqueryd.pidfile | |
I0208 14:19:09.994717 2708 extensions.cpp:300] Could not autoload extensions: Failed reading: \ProgramData\osquery\extensions.load | |
I0208 14:19:10.058359 7364 watcher.cpp:549] osqueryd watcher (3220) executing worker (7172) | |
I0208 14:19:10.105185 8500 init.cpp:377] osquery worker initialized [watcher=3220] | |
I0208 14:19:10.120802 8500 rocksdb.cpp:132] Opening RocksDB handle: \ProgramData\osquery\osquery.db | |
I0208 14:19:10.174966 6544 interface.cpp:338] Extension manager service starting: \\.\pipe\osquery.em | |
I0208 14:19:10.253082 7692 events.cpp:746] Starting event publisher run loop: windows_event_log | |
I0208 14:19:10.253082 8500 main.cpp:106] Not starting the distributed query service: Distributed query service not enabled. | |
I0208 14:20:00.473304 2976 database.cpp:119] Resetting the database plugin: rocksdb | |
I0208 14:20:00.473304 2976 rocksdb.cpp:132] Opening RocksDB handle: \ProgramData\osquery\osquery.db | |
// Direct use of paramters over flagfile | |
$ .\osqueryd\osqueryd.exe --verbose --tls_dump --enroll_secret_path=c:\programdata\osquery\heroku.secret --tls_server_certs=c:\programdata\osquery\test-fleet.herokuapp.com.pem --tls_hostname=myherokutestapp.herokuapp.com:443 --host_identifier=hostname --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_tls_refresh=10 --disable_distributed=false --distributed_plugin=tls --distributed_interval=10 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls --logger_tls_endpoint=/api/v1/osquery/log --logger_tls_period=10 | |
I0208 14:32:33.242455 5968 init.cpp:380] osquery initialized [version=2.11.2] | |
I0208 14:32:33.334389 5968 system.cpp:344] Found stale process for osqueryd (9876) | |
I0208 14:32:33.334389 5968 system.cpp:377] Writing osqueryd pid (2928) to \ProgramData\osquery\osqueryd.pidfile | |
I0208 14:32:33.351397 5968 extensions.cpp:300] Could not autoload extensions: Failed reading: \ProgramData\osquery\extensions.load | |
I0208 14:32:33.407657 3128 watcher.cpp:549] osqueryd watcher (2928) executing worker (3156) | |
I0208 14:32:33.470058 2336 init.cpp:377] osquery worker initialized [watcher=2928] | |
I0208 14:32:33.485776 2336 rocksdb.cpp:132] Opening RocksDB handle: \ProgramData\osquery\osquery.db | |
I0208 14:32:33.521971 4128 interface.cpp:338] Extension manager service starting: \\.\pipe\osquery.em | |
I0208 14:32:33.521971 2336 tls_enroll.cpp:63] TLSEnrollPlugin requesting a node enroll key from: https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll | |
I0208 14:32:33.588241 7456 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109 | |
I0208 14:32:33.603744 7456 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed | |
I0208 14:32:33.603744 4244 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109 | |
I0208 14:32:33.603744 4244 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed | |
I0208 14:32:34.689064 2336 tls.cpp:198] TLS/HTTPS POST request to URI: https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll | |
{"enroll_secret":"","host_identifier":"testPC","platform_type":"2","host_details":{"os_version":{"build":"16299","codename":"Windows 10 Enterprise","major":"10","minor":"0","name":"Microsoft Windows 10 Enterprise","platform":"windows","platform_like":"windows","version":"10.0.16299"},"osquery_info":{"build_distro":"windows10","build_platform":"windows","config_hash":"","config_valid":"0","extensions":"active","instance_id":"fbdb55c6-0d0a-42b1-9555-a","pid":"3156","start_time":"1518100353","uuid":"03000200-0400-0500-0006-a","version":"2.11.2","watcher":"2928"},"platform_info":{"revision":"4.6","vendor":"American Megatrends Inc.","version":"F5"},"system_info":{"computer_name":"testPC","cpu_brand":"AMD A8-7600 Radeon R7, 10 Compute Cores 4C+6G \u0000","cpu_logical_cores":"4","cpu_physical_cores":"2","cpu_subtype":"-1","cpu_type":"x86_64","hardware_model":"To be filled by O.E.M.","hardware_serial":"To be filled by O.E.M.","hardware_vendor":"Gigabyte Technology Co., Ltd.","hardware_version":"-1","hostname":"testPC.BHS.INTERNAL","local_hostname":"testPC","physical_memory":"7436816384","uuid":"03000200-0400-0500-0006-a"}}} | |
W0208 14:32:35.360852 2336 tls_enroll.cpp:70] Failed enrollment request to https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll (Request error: short read) retrying... | |
I0208 14:32:36.422719 4740 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109 | |
I0208 14:32:36.422719 4740 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed | |
I0208 14:32:36.422719 4752 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109 | |
I0208 14:32:36.438349 4752 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed | |
I0208 14:32:37.520140 2336 tls.cpp:198] TLS/HTTPS POST request to URI: https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll | |
{"enroll_secret":"rvHrqStn1kMUO6T5uaTBpjzE3++zCPIh","host_identifier":"testPC","platform_type":"2","host_details":{"os_version":{"build":"16299","codename":"Windows 10 Enterprise","major":"10","minor":"0","name":"Microsoft Windows 10 Enterprise","platform":"windows","platform_like":"windows","version":"10.0.16299"},"osquery_info":{"build_distro":"windows10","build_platform":"windows","config_hash":"","config_valid":"0","extensions":"active","instance_id":"fbdb55c6-0d0a-42b1-9555-a","pid":"3156","start_time":"1518100353","uuid":"03000200-0400-0500-0006-a","version":"2.11.2","watcher":"2928"},"platform_info":{"revision":"4.6","vendor":"American Megatrends Inc.","version":"F5"},"system_info":{"computer_name":"testPC","cpu_brand":"AMD A8-7600 Radeon R7, 10 Compute Cores 4C+6G \u0000","cpu_logical_cores":"4","cpu_physical_cores":"2","cpu_subtype":"-1","cpu_type":"x86_64","hardware_model":"To be filled by O.E.M.","hardware_serial":"To be filled by O.E.M.","hardware_vendor":"Gigabyte Technology Co., Ltd.","hardware_version":"-1","hostname":"testPC.BHS.INTERNAL","local_hostname":"testPC","physical_memory":"7436816384","uuid":"03000200-0400-0500-0006-a"}}} | |
W0208 14:32:37.535724 2336 tls_enroll.cpp:70] Failed enrollment request to https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll (Request error: short read) retrying... | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
@Jackbennett I am also facing the same issue as above. Any solution?