kolide/launcher

Osquery checkup returns "failed to run" on Windows even when successful

RebeccaMahany opened this issue · 4 comments

On Windows, doctor output looks like this for the osquery checkup:

Osquery: failed to run: running launcher interactive: running C:\ProgramData\Kolide\Launcher-kolide-k2\data\updates\launcher\1.11.2\launcher.exe interactive: err exit status 1, output +-------+--------------------------------------+--------------------------------------+---------+------------------------------------------+--------------+------------+----------------+--------------+------------+---------+---------------+
| pid   | uuid                                 | instance_id                          | version | config_hash
                   | config_valid | extensions | build_platform | build_distro | start_time | watcher | platform_mask |
+-------+--------------------------------------+--------------------------------------+---------+------------------------------------------+--------------+------------+----------------+--------------+------------+---------+---------------+
| redacted | redacted | redacted | 5.13.1  | redacted | 1            | active     | windows        | 10           | 1729106122 | -1      | 2             |
+-------+--------------------------------------+--------------------------------------+---------+------------------------------------------+--------------+------------+----------------+--------------+------------+---------+---------------+

I think the interactive query is running successfully, but then the interactive process remains running, and eventually we hit the timeout?

We did launcher interactive over something like runsimple to test launcher <=> osquery communication, but if there's no other way to fix this, we should just switch to runsimple.

Yeah -- my memory is that we did it this way to test 3 things. (Which is a little clever, but it's a bit of a e2e test)

  1. Does interactive work?
  2. Does launcher - osquery socket work?
  3. Record the output, make sure it finds the right osquery, etc

Of those, I think the first two are more important, and run simple won't test those.

I was thinking that if we're having issues with 2), we'd see that reflected in the logs anyway -- but true re: interactive. I'll see if I can get it figured out!

I assume this is weird fallout from that whole shift to windowsgui

We fixed the timeout issue, but I see a new one on v1.12.3 of launcher -- reopened.