Failed to load queries in UI

[crazydjango]

Fleet version (fleetctl version): 3.8.0, 3.9.0
Operating system (e.g. macOS 11.2.3): macOS 10.15.3
Web browser (e.g. Chrome 88.0.4324): Chrome Version 89.0.4389.90 (Official Build) (x86_64)
Firefox 87.0 (64-bit), Safari Version 13.0.5 (15608.5.11)

---

🧑‍💻  Expected behavior

Queries tab shows queries that are added to the Fleet and presented in the Fleet database

💥  Actual behavior

Queries tab is empty and shows "No queries available. Try creating one."

More info

Query could be seen in Queries tab after click on it in one of the Pack, but disappears after refresh

[zwass]

@crazydjango I'm not able to reproduce this locally. Are you able to reproduce it in a fresh Fleet environment (easy to get this with fleetctl preview)?

When you say after "refresh" do you mean a refresh of the entire page or are you just switching between tabs in the UI?

[crazydjango]

@zwass No, on fresh Fleet environment (fleetctl preview as you said) I'm also not able to reproduce it.
As for refresh - I meant refreshing the entire page, switching between tabs don't clear queries.

Also, if it will be useful - we use Google HTTPS Load Balancer in our environment, behind it we have two FleetDM instances.
Both GoogleLB and FleetDM instances are set to terminate https traffic (private keys are added in both places).

[zwass]

Are you able to get more information about the failed request in the network inspector there? Is there any corresponding log on the Fleet server?

[crazydjango]

@zwass Sorry for delay. In the inspector I got a link to source code (see attachment) where, I presume, error is happening, but unfortunately I don't know where to find any other valuable info. Same for corresponding log on the Fleet server. If you could advice specifically how to get more information about failed request - it would be much appreciated.

[zwass]

Can you click where it says "queries" on https://user-images.githubusercontent.com/52816727/112344172-e5b91700-8cd4-11eb-9845-154771766677.png? That should hopefully give some more information about what happened with the request, rather than showing us where in the JavaScript the error was handled.

[crazydjango]

Sure, I have request headers info and request call stack - do you need any info from bundle from the call stack?

[zwass]

Are there any response headers, or any information in the response tab of the inspector?

[crazydjango]

Unfortunately no, it shows "Failed to load response data" in the Preview and Response tabs

[zwass]

@crazydjango are you still seeing this issue?

[crazydjango]

@zwass Unfortunately yes, even after last upgrade to 3.12.0

[gillespi314]

@crazydjango, our 4.0 release is coming very soon. If you have a chance to try out the new release and are still seeing this issue, you would please let us know if the issue is still persisting?

[zwass]

@crazydjango I am also wondering whether this could be something to do with the load balancer you are using... If you connect directly to a Fleet server do you still see the issue?

[crazydjango]

@gillespi314 Yes, we will definitely try new release as soon as it will come out and as a first thing we will check this issue.
@zwass We use direct connection to Fleet server to administrate it from UI. Load Balancers are only used for osquery clients connections.

[dtilloy-criteo]

I got the same issue, and finally found the root cause:

• packs and queries are created via YAML files
• a pack was using a query with a typo in the query name ("query" instead of "Query")

Fixing the case in the query name fixed the issue for me.
Hope this could help.

David.

[gillespi314]

@dtilloy-criteo, thanks for sharing your learnings 😃
@crazydjango, please give David's fix a try and let us know if it helps to resolve the issue for you!

[crazydjango]

@dtilloy-criteo Hi, thank you for sharing!
@gillespi314 Definitely will try it, but, unfortunately, only in two weeks, because right now I'm on a vacation without an access to my Fleet environment.

[RachelElysia]

@gillespi314 @zwass can we close this?

[zwass]

I'm going to close this as we don't have the necessary information to proceed. @crazydjango please open a new Issue if you encounter more problems.