Home / Using Kolide / Reporting Problems

Reporting Problems

If you or your users are experiencing a problem with the Kolide service, it’s important to report it right away. Certain classes of problems, when reported by customers, are valuable early warning indicators allowing Kolide engineers to address an emerging issue before it impacts others.

How To Report a Problem

Before Reporting:

Before reporting a problem, first verify that the Kolide Service is not experiencing any availability issues by checking our status page.

Next, review our known issues list to see if Kolide is already aware of the problem. Even if Kolide is aware of the issue, your report is still appreciated, as additional reports can be helpful in understanding the impact of a particular problem.

The fastest way to report a problem is to contact support. When contacting support, it’s often useful to have the following information ready to share:

The name/email address of the impacted user.
The URL to the device’s details page (if applicable), or, the serial number and type of device (e.g., macOS).
The date/time the issue last occurred (the more precise, the better).
If possible, ask the user to obtain a Kolide Agent Flare.

Kolide Agent Flares:
As of November 20th, 2023, Kolide staff are now capable of obtaining an Agent Flare report remotely. However, there are some circumstances where this is not possible (e.g., the agent has connectivity problems). In these situations, it’s helpful for the end-user to provide the flare.
Any notable changes that could have led to the issue (e.g., recent updates, new security tool deployed, etc.).

Once you have this info, simply contact support. If this is a new issue, Kolide will investigate it, and if appropriate, will add it to our known issues list.

Known Issues

Before spending time investigating and reporting an issue, it is possible that Kolide is already aware of the problem. Review the section below for issues that describe the problem you might be experiencing.

Active Issues

Known issues with macOS 15 Sequoia

First Reported

Monday, June 10th, 2024

Issue #1 - Kolide Agent Detection Fails in Safari

This meta-issue is tracking the following known compatibility issues with Kolide and macOS 15 Sequoia (released as private developer beta on June 10th, 2024).

Due to changes in how Safari upgrades certain types of HTTP requests, Kolide’s agent detection strategy for Safari no longer functions. As a result, end-users will be erroneously presented with an error message that the agent cannot be detected.

Workaround Steps:

Open Safari
Click Safari in the Menubar and choose Settings….
In the Feature Flags tab, search for the setting called Upgrade upgradable mixed content.
Uncheck the box

Issue #2 - Kolide Reports An Incorrect Firewall Status

Currently, Kolide does not accurately detect the state of the macOS 15 firewall, erroneously believing that it is off, when it may be in the enabled state.

Issue #3 - Kolide Reports An Incorrect Auto Update Managed Status

Currently, Kolide does not accurately detect if macOS 15’s automatic update is being managed by a profile or MDM.

Issue #4 - Kolide’s Agent Caused a Network Permissions Pop-Up to Appear

Kolide will present a user a permissions dialog that has the following text:

“osquery” would like to find devices on your local networks. This will allow the app to discover, connect to, and collect data from devices on your network.

Current Status

June 10th, 2024 - Kolide adds issue to “Known Issues” list.
June 10th, 2024 - Kolide receives reports of Issue #‘s: 1,2,3, and 4.
June 12th, 2024 - Kolide releases Agent version 1.7.1, which contains important changes necessary to fix Issue #1.

Factor Enrollment Timeout During Registration

First Reported

November 2023

Problem

Rarely, an end-user will receive an error during Kolide registration that says, Factor Enrollment Has Timed Out.

This occurs in scenarios where Okta does not send Kolide a webhook in a timely manner or fails to send it entirely.

Workaround

A Kolide administrator can manually verify the enrollment by performing the following steps:

In the search box in the primary navigation, enter the email or name of the impacted user. Click on the correct person when they appear in the search result.
Select Okta Identities in the sub-navigation.
Locate the primary identity and horizontally scroll the table to the right to reveal additional actions.
Click the circle with the checkbox in it, with the tooltip Manually verify enrollment.
Click OK when the confirmation dialog appears.

Current Status

November 2023 - Kolide receives first report of issue.
November 24th, 2023 - Adds issue to “Known Issues” list.
May 14th, 2024 - Kolide mitigates a key root cause of Factor Timeouts with an improved registration flow. Kolide is continuing to monitor the issue.

Resolved Issues

Menu Bar App And Notifications Won’t Open Browser When Using Wayland On Recent Versions Of Ubuntu

First Reported

Thursday, January 11th, 2024

Problem

An update to Wayland on more recent versions of Ubuntu prevents the Kolide Agent from launching a browser. This impacts users’ ability to open URLs from the menu bar app and by clicking on notifications from the Kolide Agent.

This occurs on Ubuntu 23.04 and 23.10.

Workaround

Switching from using Wayland to X11 when logging in will allow you to open URLs from the menu bar application and notifications. After you have switched to using X11, restart the launcher service via sudo systemctl restart launcher.kolide-k2.service.

Current Status

January 11th, 2024 - Kolide receives first report.
January 16th, 2024 - Adds issue to “Known Issues” list.
February 14th, 2024 - Kolide releases Agent version 1.5.3 which resolves this issue.
June 13th, 2024 - Moves issue to “Resolved Issues” list.

Windows Agent Stops Checking In After Waking From Sleep

First Reported

November 23rd, 2023

Problem

The osquery component of the Kolide agent occasionally stops checking into the Kolide service due to an issue in the agent’s startup routine.

End-users experiencing this problem will have their devices correctly identified during authentication, but no checks will be able to run. Eventually, they will be unable to authenticate as Kolide will not have any fresh data about their device, and they will be stuck waiting for checks to complete.

Kolide engineers have observed this is a relatively rare issue with a low chance of occurring during the Kolide agent’s startup routine. This startup routine occurs during:

When the computer first boots
When the OS wakes from standby or hibernation
When the automatic upgrade process restarts the agent

Once the end-user notices the issue, it’s unlikely the agent is capable of recovering by itself without the end-user or the administrator employing the workarounds listed below.

Workaround

The problem is typically resolved by any of the following actions:

Rebooting the device
Repairing the agent
Uninstalling / Re-installing the agent

Current Status

November 23rd, 2023 - Kolide receives first report of issue.
November 29th, 2023 - Kolide receives second report of issue.
December 19th, 2023 - Kolide releases Agent version 1.3.2 which partially resolves some of the root causes.
March 13th, 2024 - Kolide releases Agent version 1.6.2 which fully resolves all remaining known root causes.
June 13th, 2024 - Moves issue to “Resolved Issues” list.

Kolide Menu Bar App Not Displaying on macOS

First Reported

October 2023

Problem

Occasionally, the Kolide Menu Bar app does not show on the macOS menu bar even though the Kolide agent is working correctly.

This problem most commonly occurs immediately following the installation of a macOS update. Subsequent restarts are not affected.

Workaround

As mentioned above, restarting the computer often immediately resolves the issue until the next macOS update.

Current Status

October 2023 - Kolide receives first report of issue.
November 24th, 2023 - Adds issue to “Known Issues” list.
June 13th, 2024 - Adds issue to “Resolved Issues” list as Kolide has not received recent reports of this issue since it was first reported.

Kolide Agent Stops Working After Automatic Update Until Reboot

First Reported

Tuesday, December 5th, 2023

Problem

When Kolide issues an automatic update to the Kolide Agent, there is a very low chance that the agent will fail to automatically restart after the update is completed.

If this occurs, users will not be able to successfully complete device trust authentication, and Kolide will report that it is unable to locate the agent on the end-user’s device.

This occurs on all platforms the Kolide agent supports (macOS, Windows, and Linux).

Workaround

Restarting the agent will cause the agent to work normally. This is most easily accomplished by asking an end-user to reboot their computer.

Current Status

December 5th, 2023 - Kolide receives first report of issue.
December 7th, 2023 - Adds issue to “Known Issues” list.
January 16th, 2024 - Moves issue to “Resolved Issues” list.

Microsoft Intune Check Fails During Upgrade

First Reported

Friday, December 1st, 2023

Problem

A recent Microsoft Intune update (issued on November 27th) is causing Kolide to erroneously report that a device is not properly enrolled in Microsoft Intune.

After a preliminary investigation, Kolide has observed that the most recent Intune update temporarily terminates the processes associated with a normal and functioning Intune installation. Then, after an unknown period, the process restarts.

During this window, Kolide will not allow a device to pass the Microsoft Intune Check. If you block authentication based on this Check, devices experiencing this issue may be unable to sign in. If you block registration based on this Check, it may prevent otherwise valid devices from registering with Kolide.

Kolide engineers are continuing to investigate to provide more information about the underlying cause of the problem, its duration, and viable workarounds, and will update this Known Issue entry when we know more.

Workaround

Kolide has observed that over time, devices will recover from this state on their own. Kolide engineers are currently investigating whether restarting the device is sufficient to finalize the Intune upgrade process.

To diminish the impact of this issue, customers who are experiencing this issue are advised to temporarily turn off blocking in the Check’s settings until Kolide has shipped an update that resolves this problem.

Current Status

December 1st, 2023 - Kolide receives first report.
December 1st, 2023 - Adds issues to “Known Issues” list.
December 4th, 2023 - Kolide updates Check to remove process requirement.
December 7th, 2023 - Moves to “Resolved Issues” list.

Issues Registering Mobile/Additional Devices

First Reported

Thursday, November 23rd, 2023

Problem

Customers have reported several issues preventing users from performing self-registration for additional devices, including mobile devices. Symptoms of the issue include:

The user is repeatedly asked to authenticate with Okta during registration.
The browser refreshes repeatedly until a “Too Many Requests” error is shown.

Workaround

The problem seems to go away after clearing all Kolide cookies in the web browser. Additionally, admins can ask a user to request an admin-approved registration to work around this issue.

Current Status

November 23rd, 2023 - Kolide receives first report.
November 24th, 2023 - Adds issues to “Known Issues” list.
November 27th, 2023 - Kolide deploys a bug fix.
November 28th, 2023 - Moves to “Resolved Issues” list.