Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I0524 17:33:32.621054 10575 carver.cpp:186] Failed to post carve: No session_id received from remote endpoint

<https://holdmybeersecurity.com/2020/09/24/setup-my-golang-osquery-file-carving-server-with-kolide/>

In my blog post above I outline the file carve process. When Osquery inits a file server upload it contacts `/start_uploads` which should return a `session_id`.

I'm not sure what file server your using but it may not be generating a `session_id` .


To debug this you could generate CURL commands that act as an Osquery agent to see if a session_id is being generated.