fleet icon indicating copy to clipboard operation
fleet copied to clipboard

fleetd unresponsive on Windows

Open ksatter opened this issue 5 months ago • 1 comments

Fleet version: fleetd version: Began on v 1.41.0, persists on v1.43.0 Host OS: Windows 10 and 11 Pro

Web browser and operating system:


💥  Actual behavior

In Fleet, it was observed that certain Windows hosts were 'online', but had not fetched for an extended period.

The customer attempted to restart the fleet-osquery service. After this, hosts remained offline in Fleet.

The customer next rebooted the machine. After this, communication was re-established for a period, but eventually the host reverted to being 'online', but not refetching. This may coincide with the test host going into a sleep state and then waking again, but it is uncertain.

Observations from the orbit-osquery logs on these hosts:

  1. Frequent errors reaching the TUF server. orbit config and device token endpoints:
2025-06-18T02:43:41-04:00 INF update failed error="update metadata: client update: tuf: failed to download 8.root.json: Get \"https://updates.fleetdm.com/8.root.json\": read tcp [...]: wsarecv: An existing connection was forcibly closed by the remote host."

2025-06-10T01:40:43-04:00 INF network error error="POST /api/fleet/orbit/config: Post \"https://[...]/api/fleet/orbit/config\": dial tcp: lookup [...]: no such host"

2025-05-16T10:57:05-04:00 INF network error error="POST /api/fleet/orbit/config: Post \"https://{...}/api/fleet/orbit/config\": dial tcp: lookup [...]: no such host"

Full orbit-osquery logs, as well as Windows Event logs are available in Unthread.

I have not been able to reproduce this behavior, and do not currently see any patterns of behavior that explain why some hosts are unable to reach Fleet.

🧑‍💻  Steps to reproduce

  1. TODO
  2. TODO

🕯️ More info (optional)

N/A

ksatter avatar Jun 20 '25 21:06 ksatter

@xpkoala, this seems hard to reproduce. Perhaps we should allocate time for an engineer to look at the log. TMWYT

sharon-fdm avatar Jun 23 '25 14:06 sharon-fdm

Based on the Unthread conversation, the issue appears resolved by the reinstall. We'll keep an eye on any future reoccurances, but for now, closing this issue.

AndreyKizimenko avatar Jul 09 '25 18:07 AndreyKizimenko

In the glass city's glow, Fleet finds a steady rhythm, Windows hosts now flow.

fleet-release avatar Jul 09 '25 18:07 fleet-release