Reporting issues

[diastoleus]

Need help configuring agents to push up other handler events to the database. The only events being pushed are command and firefoxbrowser. Excel, Word, and Powerpoint events are verified to be running/executing, but not reporting as such to the database. Where should we look? We've combed through the configs multiple times.

Edit: Apparently the configs are unchanged since being tested in a single host virtual-box setup, and at that time everything was reporting without issue. I don't understand how this could be networking related though.

[sei-dupdyke]

Hi, hmm 🤔 - everything in clientupdates.log gets sent to the API, there is no filtering there, so if you see entries in clientupdates, you should definitely see them in the database.

1. Are you seeing WORD|EXCEL|POWERPOINT entries in logs/clientupdates.log?
2. If yes, are you seeing them in the API (but not in grafana or similar)?
3. if no, do you see any errors logged in logs/app.log

[sei-dupdyke]

Ok, so the client cannot get to your API server with those settings, correct (you're not running the API on localhost)? These are stored in config/application.json and easiest way to know what values to put in for localhost is to go to the host machine running your API and run (assuming its linux):

ip a

and note the IP address here. Back on the client machine, can you hit that IP address in your web browser? If so, that's the IP address to substitute in for the entries in config/application.json on the client machine.

[diastoleus]

I copy and pasted that info from your response in another thread, sorry. Yes, we are entering the api commands using our servers ip address/port.

[diastoleus]

To elaborate:

<Server_IP>:<Server_Port>/api/home == good response

<Server_IP>:<Server_Port>/api/client* == "site not working"

[sei-dupdyke]

All of the client API endpoints require headers that the client puts in - what about one like machines? Does it return all of the machines that have checked in on your range?

[diastoleus]

Yes, machines results in a good response.