Hard to understand error message when an agent option is in the wrong place

[zwass]

Fleet version: 4.59.0

---

💥  Actual behavior

Can't set logger_plugin in agent options. Error: "Couldn't update 💻🐣 Workstations (canary) team agent options:unsupported key provided: "logger_plugin"
If you're not using the latest osquery, use the fleetctl apply --force command to override validation."

This is a valid flag for osquery. Possibly it's intentionally blocked because typically we want it configured to tls? The error message isn't making that clear.

🧑‍💻  Steps to reproduce

1. Try to add logger_plugin: tls under options: on the agent options page.
2. Save and see the error

🕯️ More info (optional)

@noahtalerman: I'm working on improvements to the Agent options reference docs is here:

• Reference docs: "Agent configuration" page cleanup #25290

🛠️ To fix

Update the error message so that it's easy to understand when a configuration option is not supported v. not in the right place (options or command_line_flags).

• Unsupported flag: (no change)

Error: "Couldn't update 💻🐣 Workstations (canary) team agent options:unsupported key provided: "foo"
If you're not using the latest osquery, use the fleetctl apply --force command to override validation."

• Flag not in the right spot (should be command_line_flags):

Error: "Couldn't update 💻🐣 Workstations (canary) team agent options: "logger_plugin" key should be part of the "command_line_flags" object.

[sharon-fdm]

@noahtalerman , this is the expected behaviour. the logger_plugin can only be set when starting osquery.
The fix should be explaining this in the error.

[lucasmrod]

logger_plugin can only be set during osquery startup (as a cli flag) so you can set it in command_line_flags:

We could improve the error to explain that the cli flag should be set in command_line_flags instead.

[noahtalerman]

Noah: I'm confused...in Fleet's agent options docs we link out to osquery docs for all available options. logger_plugin is in the osquery docs. Also the example error message in the Fleet docs is confusing:

@lucasmrod I scheduled some time tomorrow for us to chat about the above.

[noahtalerman]

🛠️ To fix

Update the error message so that it's easy to understand when a configuration option is not supported v. not in the right place (options or command_line_flags).

• Unsupported flag: (no change)

Error: "Couldn't update 💻🐣 Workstations (canary) team agent options:unsupported key provided: "foo"
If you're not using the latest osquery, use the fleetctl apply --force command to override validation."

• Flag not in the right spot (should be command_line_flags):

Error: "Couldn't update 💻🐣 Workstations (canary) team agent options: "logger_plugin" key should be part of the "command_line_flags" object.

• Flag not in the right spot (should be options):

Error: "Couldn't update 💻🐣 Workstations (canary) team agent options: "audit_allow_config" key should be part of the "options" object.

@lucasmrod and I chatted and we decided to improve the error message.

Sending this bug back to the release board.

[sharon-fdm]

Hey team! Please add your planning poker estimate with Zenhub @iansltx @lucasmrod @mostlikelee

[lucasmrod]

@noahtalerman

Regarding the third one:

Flag not in the right spot (should be options):

All flags that can be in options can be defined in command_line_flags so maybe this error should not be covered and we should return a generic error like the first one.

[noahtalerman]

Regarding the third one:

Flag not in the right spot (should be options):

All flags that can be in options can be defined in command_line_flags so maybe this error should not be covered and we should return a generic error like the first one.

@lucasmrod oh! I misunderstood. Agreed we don't need this error. I removed it from the "To fix" section.