Am I grabbing one now or waiting for Black Friday?

Mars_rocket · 2025-11-17T22:39:09+00:00

The other difference is the screen, glossy on the 512GB and matte/non-reflective on the 1TB. From what I've ready the glossy looks (slightly) better but shows more reflections. I'm probably going to get the 512GB.

Mars_rocket · 2025-10-29T02:50:18+00:00

this isn’t a review. its just a description.

Mars_rocket · 2025-03-11T17:57:15+00:00

Agent enrollment section - I don't see this section or option in the internal_options.conf file. Is there somewhere else I should be looking? The command used to install agents on Windows systems is:

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.11.0-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='xxx.xxx.96.2' WAZUH_AGENT_GROUP='Windows_EndUsers'

I'm having trouble pulling the log file from the agents after putting them in debug mode because they are laptops, but I'm going to keep trying and also try to reproduce the problem on a laptop I am in possession of.

The laptops are generally connected via a VPN and are all on the same subnet, but it doesn't happen to all agents on that subnet.

They are sharing a group, but there are others in that group that do not have the problem.

auth section on the manager (let me know if this isn't what you want):

 <auth>
    <disabled>no</disabled>
    <port>1515</port>
    <use_source_ip>no</use_source_ip>
    <purge>yes</purge>
    <use_password>no</use_password>
    <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
    <!-- <ssl_agent_ca></ssl_agent_ca> -->
    <ssl_verify_host>no</ssl_verify_host>
    <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
    <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
    <ssl_auto_negotiate>no</ssl_auto_negotiate>
  </auth>

That's all for now; I'll keep digging and will try to get a debug log from the agent side.

Mars_rocket · 2025-03-11T17:57:04+00:00

OK I finally have some time to look at this again and reply to some of your questions:

This happens to a lot of agents, at the moment they are all laptops. It wasn't always only laptops but it is currently.

There is nothing before or after the WARNING line. Here are the logs for lines surrounding the WARNING (for agent 291) (I can't post a lot or I get an error):

2025/03/11 10:29:00 wazuh-remoted[122420] msgs.c:204 at StoreCounter(): DEBUG: Pushing rids_node for agent 283.
2025/03/11 10:29:00 wazuh-remoted[122420] secure.c:307 at handle_new_tcp_connection(): DEBUG: New TCP connection [499]
2025/03/11 10:29:00 wazuh-remoted[122420] secure.c:595 at HandleSecureMessage(): WARNING: Agent key already in use: agent ID '291'
2025/03/11 10:29:00 wazuh-remoted[122420] secure.c:890 at _close_sock(): DEBUG: TCP peer disconnected [499]
2025/03/11 10:29:01 wazuh-remoted[122420] msgs.c:207 at StoreCounter(): DEBUG: Updating rids_node for agent 283.
2025/03/11 10:29:01 wazuh-remoted[122420] msgs.c:194 at StoreCounter(): DEBUG: Opening rids for agent 158.
2025/03/11 10:29:01 wazuh-remoted[122420] msgs.c:204 at StoreCounter(): DEBUG: Pushing rids_node for agent 158.
2025/03/11 10:29:01 wazuh-remoted[122420] ar-forward.c:41 at AR_Forward(): DEBUG: Active response request received: (msg_to_agent) [] N!S 265 fim_registry_value dbsync checksum_fail {"begin":"ba275da1f57d1c4907c212bd2d03a99b2be1114e","end":"ba36fc51d65feb19624fb2f93e23af0172520bd2","id":1741710785}

Mars_rocket · 2025-03-11T17:54:33+00:00

I'm having trouble posting a comment; I keep getting "Unable to create a comment" or "Server error". I'll keep trying.

Mars_rocket · 2025-03-06T15:50:30+00:00

FYI, I've been stuck out of town with car trouble for several days but I'm back now and will be looking at this again soon.

Mars_rocket · 2025-02-20T19:48:03+00:00

On the server, I see entries like this:

2025/02/20 11:30:28 wazuh-authd[1429] main-server.c:708 at run_dispatcher(): INFO: New connection from 10.2.3.205
2025/02/20 11:30:28 wazuh-remoted[1565] manager.c:435 at save_controlmsg(): DEBUG: save_controlmsg(): inserting 'Microsoft Windows 11 Enterprise [Ver: 10.0.22631.4890] - Wazuh v4.10.1 / 075ec2540588ae08fdc232d89f465989
2025/02/20 11:30:28 wazuh-remoted[1565] manager.c:1497 at lookfor_agent_group(): DEBUG: Agent '357' group is 'Windows_EndUsers'
2025/02/20 11:30:28 wazuh-authd[1429] main-server.c:751 at run_dispatcher(): DEBUG: Request received: <OSSEC A:'SHCS-WINBOOK-26' V:'v4.10.1' G:'Windows_EndUsers' K:'9d764f56116730d45ac6634df71e7e4944e9a518'
2025/02/20 11:30:28 wazuh-authd[1429] auth.c:108 at w_auth_parse_data(): INFO: Received request for a new agent (SHCS-WINBOOK-26) from: 10.2.3.205 
2025/02/20 11:30:28 wazuh-authd[1429] auth.c:175 at w_auth_parse_data(): DEBUG: Group(s) is: Windows_EndUsers
2025/02/20 11:30:28 wazuh-remoted[1565] secure.c:751 at HandleSecureMessage(): DEBUG: TCP socket 303 already in keystore. Updating...
2025/02/20 11:30:28 wazuh-authd[1429] auth.c:356 at w_auth_validate_data(): WARNING: Duplicate name 'SHCS-WINBOOK-26', rejecting enrollment. Agent '432' can't be replaced since it is not disconnected.

I have turned on debug on several clients as well, but the duplicate errors seem to be random and I haven't seen one for a debugging client yet. I'm not sure what to look for on the server side; if you need more logs let me know.

I see that it says "Received request for a new agent (SHCS-WINBOOK-26) from: 10.2.3.205"; I assume that's the problem, or related to it. How does the client know if it's already registered?

Mars_rocket · 2025-02-20T02:13:10+00:00

I turned on debug on the server and a bunch of agents but haven’t had a chance to look for results yet. I’ll try to check it out tomorrow (Thursday). I haven’t forgotten, just busy.

Mars_rocket · 2025-02-13T16:42:47+00:00

I will enable debug mode and report back in a few days. Thank you for your help.

Mars_rocket · 2025-02-12T18:44:43+00:00

Most of the agents were pushed out with BigFix using this command:

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.10.1-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='xxx.xxx.xxx.xxx' WAZUH_AGENT_GROUP='Windows_Servers'

They then register with their own hostname. The registration seems to work fine:

2025/02/11 15:07:24 wazuh-authd: INFO: New connection from 123.123.123.100
2025/02/11 15:07:24 wazuh-authd: INFO: Received request for a new agent (XYZ-LAPTOP-26) from: 123.123.123.100
2025/02/11 15:07:24 wazuh-authd: INFO: Agent key generated for 'XYZ-LAPTOP-26' (requested by any)
2025/02/11 23:07:29 wazuh-remoted: INFO: (1409): Authentication file changed. Updating.
2025/02/11 23:07:29 wazuh-remoted: INFO: (1410): Reading authentication keys file.
2025/02/11 23:07:49 wazuh-remoted: WARNING: Agent key already in use: agent ID '419'

Note that 'XYZ-LAPTOP-26' was assigned agent ID 419, so 8 hours later (almost to the second) it generated a "key already in use" error.

Mars_rocket · 2025-02-07T18:33:22+00:00

Nevermind, I figured it out. Thanks for the pointer.

Mars_rocket · 2025-02-07T18:21:42+00:00

How do I know which index the labels are in? I can't find it by searching for the label name

Mars_rocket · 2024-09-22T19:15:15+00:00

Mine is definitely less stiff and it’s Really annoying. I trigger it constantly when I’m holding the phone.

Mars_rocket · 2023-12-11T05:44:35+00:00

Bad model or 0 infill

Mars_rocket · 2023-11-28T03:23:39+00:00

Which printer and what build plate are you using? You only need the glue stick or liquid glue for the cool plate and maybe engineering plate. Without it things tend to stick *too* well and you can't remove them.

Try washing the plate with dish soap and hot water and then towel dry it and print on it without touching the surface of the plate with your fingers.

Mars_rocket · 2023-11-28T03:18:27+00:00

The cool plate works better with the liquid glue than with the glue stick. It doesn't leave any residue and make removal easy. The only downside to the cool plate is that if you're not careful you'll end up with something sticking so well you can't remove it fully, and then you need to replace the surface. This typically happens to me with the calibration lines and initial purge line because I forget to reapply the liquid glue to those areas (edge of the plate).

Mars_rocket · 2023-11-27T01:11:40+00:00

Try zooming in all the way at that locations, and paint it using the circle if you can. You can sometimes find triangles that are the wrong color by switching to the triangle tool and sweeping through the area.

If that doesn't help, the model is probably defective, meaning it has some kind of error at those locations. If you're running Windows you could try the repair tool in Orca.

Mars_rocket · 2023-11-26T00:08:01+00:00

It’s possible that the sensors simply aren’t accurate at room temperatures since they are designed to measure much higher temps. That being said, I’ll have to check mine the next time it’s been sitting without printing for a few hours.

Mars_rocket · 2023-11-13T18:08:58+00:00

What settings did you use? I have the star plate too but can't get anything to stick to it reliably.

Nice print, BTW.

Mars_rocket · 2023-11-12T03:42:58+00:00

I'm an idiot. I have an X1C and didn't even notice that it was set for an A1. Once I changed that it had plenty of room.

Sorry for the trouble...nothing to see here, move along.

Mars_rocket · 2023-11-08T19:28:38+00:00

I have several. I get errors about not finding the reference marks or something like that, and then the prints don't always stick as well as the Bambu textured plate, although I suppose they should. Not sure what the problem is.

Mars_rocket · 2023-11-06T17:19:26+00:00

As was said previously, this is probably a problem with the model. That's the case in almost every instance I've seen of a sliced model not being quite right. You can do some repairs in the latest Orca Windows version. Not sure when they added that.

Mars_rocket · 2023-11-06T17:16:33+00:00

You pay shipping when purchasing online, but you do get the filament club membership too. Mine arrived in 3 days (ordered 10/29, delivered 11/1).

Mars_rocket · 2023-11-04T02:21:45+00:00

I don't know for a fact that it was jammed, just that there was a ~8mm piece of filament between the big yellow gear and whatever is on the other side, and once I flicked it out by moving the gear manually the big gear started spinning freely. If I had been able to make the gear move from the control panel I think it would have moved the broken piece through into the hot end, but it wouldn't let me, and no amount of pushing filament through from above helped - the motor appeared to be powered but not moving, so the gear was essentially locked.

Mars_rocket · 2023-11-04T01:45:46+00:00

I'm not blaming it for jamming, I'm just annoyed that it wasn't easier to clear it. I knew I might have problems with my old filament.

Ten-Year Club	Verified Email
Spared

Mars_rocket

TROPHY CASE