Orbital Troubleshooting


This troubleshooting topic contains information that relates to both the Windows and macOS operating systems. Information specific to the Windows operating system is contained in its own help topic, as is information specific to macOS.

SSL Proxies

Orbital does not support SSL proxies.


Orbital and osquery Logging

Orbital’s node on an endpoint does not log to their own, separate files. Instead, they log to the operating system’s native log files. This means that:

osquery logs are included with these Orbital logs, as an osqueryd subcomponent.


Orbital Service (Node) Not Installing

Symptoms

Things to Check


Forensic Snapshot from Secure Endpoint is Timing Out

Symptoms

Things to Check


Last Seen Timestamps


Orbital-related Secure Endpoint Events


The Constraint Failed Error Message

Symptom

You receive the error message: Constraint Failed: The table was queried without a required column in the WHERE clause to limit the output.

Reason for Error

There are several tables that require constraints be defined in the query or they will not succeed. For example, the file table will not return every file on the system, nor will the hash table hash every file on the system. These tables require constraints and the failure to provide them will result in the error listed above.

Possible Solution

Check the table in the schema in the osquery documentation and see which column requires a constraint, and then rewrite the query accordingly.

More Info

Return to Table of Contents