From 846b3537c04e8e4a303be275cad49ed1882eaf38 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Thu, 21 Dec 2023 12:15:25 -0600 Subject: [PATCH] Improved error message when Fleet cannot write osquery log results to logging destination. (#15726) Improved error message when Fleet cannot write osquery log results to logging destination. #15455 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. --- changes/15455-logging-issues | 1 + server/service/osquery.go | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 changes/15455-logging-issues diff --git a/changes/15455-logging-issues b/changes/15455-logging-issues new file mode 100644 index 0000000000..82e60442ab --- /dev/null +++ b/changes/15455-logging-issues @@ -0,0 +1 @@ +Improved error message when Fleet cannot write osquery log results to logging destination. \ No newline at end of file diff --git a/server/service/osquery.go b/server/service/osquery.go index 97bdfb0ac9..5fb45bab0d 100644 --- a/server/service/osquery.go +++ b/server/service/osquery.go @@ -1578,7 +1578,11 @@ func (svc *Service) SubmitResultLogs(ctx context.Context, logs []json.RawMessage } if err := svc.osqueryLogWriter.Result.Write(ctx, filteredLogs); err != nil { - return newOsqueryError("error writing result logs: " + err.Error()) + return newOsqueryError( + "error writing result logs " + + "(if the logging destination is down, you can reduce frequency/size of osquery logs by " + + "increasing logger_tls_period and decreasing logger_tls_max_lines): " + err.Error(), + ) } return nil }