Launcher Agent Windows Debugging

Reboot

Rebooting the machine is a good first step.

Third Party Tools

Some third party anti-virus or or anti-malware tools will terminate launcher and/or osqueryd. If this is occurring, launcher may exist without any logging. Please check the management console of your tools.

Reading Logs

Service Controller

Launcher runs as a windows service. When there are issue starting launcher, the service controller will usually log something. These message can be retrieved using an administrator powershell:

Get-EventLog  -Newest 5 -LogName System -Source "Service Control Manager" -Message "*launcherkolidek2svc*"

Launcher Logs

Launcher itself logs through the windows event logs. These logs can be retrieved using an administrator powershell:

Get-WinEvent -MaxEvents 30 -FilterHashtable @{
   LogName='Application'
   ProviderName='launcher'
} | select -ExpandProperty message

Debug Mode

Running Launcher in Debug Mode

Edit cd "c:\Program Files\Kolide\Launcher-kolide-k2\conf\launcher.flags" to include a line saying debug . Then restart the service.

Starting Launcher in the foreground

Launcher can be run from an administrator powershell. This will produce logs in that window directly.

Stop-Service LauncherKolideK2Svc
cd "c:\Program Files\Kolide\Launcher-kolide-k2"
.\bin\launcher.exe svc-fg -config .\conf\launcher.flags