From a0497ecd77f9d8d32e6ef21f9a76817b8a811bf3 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Tue, 4 Feb 2025 11:15:29 -0600 Subject: [PATCH] Added debug logging to declaration configurations status. (#26020) For #25812 I am adding some debug logging for DDM configuration profile status to assist in future potential debug. This change should have no noticeable functional changes. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Manual QA for all new/changed functionality --- changes/25812-ddm-profiles-stuck | 1 + server/fleet/apple_mdm.go | 2 +- server/service/apple_mdm.go | 21 +++++++++++++++++---- 3 files changed, 19 insertions(+), 5 deletions(-) create mode 100644 changes/25812-ddm-profiles-stuck diff --git a/changes/25812-ddm-profiles-stuck b/changes/25812-ddm-profiles-stuck new file mode 100644 index 0000000000..ca2a654545 --- /dev/null +++ b/changes/25812-ddm-profiles-stuck @@ -0,0 +1 @@ +Added server debug logging for unexpected Apple DDM configuration status. diff --git a/server/fleet/apple_mdm.go b/server/fleet/apple_mdm.go index 485988029e..d2939956b7 100644 --- a/server/fleet/apple_mdm.go +++ b/server/fleet/apple_mdm.go @@ -841,7 +841,7 @@ type MDMAppleDeclarationValidity string const ( MDMAppleDeclarationValid MDMAppleDeclarationValidity = "valid" MDMAppleDeclarationInvalid MDMAppleDeclarationValidity = "invalid" - MDMAppleDeclarationUnknown MDMAppleDeclarationValidity = "valid" + MDMAppleDeclarationUnknown MDMAppleDeclarationValidity = "unknown" ) // MDMAppleDDMStatusDeclaration represents a processed declaration for the client. diff --git a/server/service/apple_mdm.go b/server/service/apple_mdm.go index 993a6c5ffb..b008800d3b 100644 --- a/server/service/apple_mdm.go +++ b/server/service/apple_mdm.go @@ -4331,12 +4331,12 @@ func (svc *MDMAppleDDMService) handleConfigurationDeclaration(ctx context.Contex } func (svc *MDMAppleDDMService) handleDeclarationStatus(ctx context.Context, dm *mdm.DeclarativeManagement) error { - var status fleet.MDMAppleDDMStatusReport - if err := json.Unmarshal(dm.Data, &status); err != nil { + var statusReport fleet.MDMAppleDDMStatusReport + if err := json.Unmarshal(dm.Data, &statusReport); err != nil { return ctxerr.Wrap(ctx, err, "unmarshalling response") } - configurationReports := status.StatusItems.Management.Declarations.Configurations + configurationReports := statusReport.StatusItems.Management.Declarations.Configurations updates := make([]*fleet.MDMAppleHostDeclaration, len(configurationReports)) for i, r := range configurationReports { var status fleet.MDMDeliveryStatus @@ -4347,8 +4347,21 @@ func (svc *MDMAppleDDMService) handleDeclarationStatus(ctx context.Context, dm * case r.Valid == fleet.MDMAppleDeclarationInvalid: status = fleet.MDMDeliveryFailed detail = apple_mdm.FmtDDMError(r.Reasons) - default: + case r.Valid == fleet.MDMAppleDeclarationValid: // should be rare/never + // The debug messages here can be used to figure out why a DDM profile is stuck in a certain state on a device. + level.Debug(svc.logger).Log("msg", "valid but inactive declaration status", "status", r.Valid, "active", r.Active, "host", + dm.UDID, "declaration", r.Identifier) status = fleet.MDMDeliveryVerifying + case r.Valid == fleet.MDMAppleDeclarationUnknown: // should be rare + level.Debug(svc.logger).Log("msg", "unknown declaration status", "status", r.Valid, "active", r.Active, "host", dm.UDID, + "declaration", r.Identifier) + status = fleet.MDMDeliveryVerifying + default: + // This should never happen. If we see this happening, we should handle it. + level.Error(svc.logger).Log("msg", "undefined declaration status", "status", r.Valid, "active", r.Active, "host", dm.UDID, + "declaration", r.Identifier) + status = fleet.MDMDeliveryFailed + detail = fmt.Sprintf("undefined declaration status: %s; %s", r.Valid, apple_mdm.FmtDDMError(r.Reasons)) } updates[i] = &fleet.MDMAppleHostDeclaration{