diff --git a/changes/15455-logging-issues b/changes/15455-logging-issues new file mode 100644 index 000000000..82e60442a --- /dev/null +++ b/changes/15455-logging-issues @@ -0,0 +1 @@ +Improved error message when Fleet cannot write osquery log results to logging destination. \ No newline at end of file diff --git a/server/service/osquery.go b/server/service/osquery.go index 97bdfb0ac..5fb45bab0 100644 --- a/server/service/osquery.go +++ b/server/service/osquery.go @@ -1578,7 +1578,11 @@ func (svc *Service) SubmitResultLogs(ctx context.Context, logs []json.RawMessage } if err := svc.osqueryLogWriter.Result.Write(ctx, filteredLogs); err != nil { - return newOsqueryError("error writing result logs: " + err.Error()) + return newOsqueryError( + "error writing result logs " + + "(if the logging destination is down, you can reduce frequency/size of osquery logs by " + + "increasing logger_tls_period and decreasing logger_tls_max_lines): " + err.Error(), + ) } return nil }