https://github.com/osquery/osquery logo
Join Slack
Channels
general
android_tests
apple-silicon
arm-architecture
auditing-warroom
awallaby
aws
beyond-identity
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
golang
goquery
help-proxy
infrastructure
jobs
kolide
linen-dev
linux
loonsecio
macos
officehours
osctrl
plugins
process-auditing
qingteng
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Powered by
# general
  • e

    ET

    03/02/2021, 8:11 PM
    Hi guys, In my organization there is Windows DC׳s servers with a lot of login users (around 50 users). When I tried to ask query from users or logged_in_users table the process was hang until I kill the process. Anyone meet this? An idea for a solution? osquery 4.3.0
    m
    • 2
    • 12
  • s

    sanjaykcse

    03/05/2021, 10:41 AM
    I am getting peculiar issue with osquery daemon. In my setup , osquery daemon is taking to fleet and configure to send log/results to fleet. If fleet is down or there is no connectivity between fleet and osqueryd for 3- mins to 1hr , the worker thread is getting segfault and core dumps continuously . If I set logger_plugin to filesystem , fleed does not receive results also . Any suggestion , how to fix this ?
    👀 1
    • 1
    • 3
  • m

    manoj434

    03/08/2021, 4:06 AM
    I am trying to import osquery conf files(packs) in fleet. I don't see any option in UI. Can anyone give me some pointers if I can import conf files directly instead of creating them manually via fleet UI.
    d
    c
    • 3
    • 3
  • d

    Dan Achin

    03/08/2021, 6:39 PM
    hello everyone.  I think this question belongs here vs #C01DXJL16D8, but could go either way I guess.  After watching one of the presentations at osquery@scale (Reliable osquery deployment for the paranoid), we have decided that we are going to manage our osquery config at our clients (via puppet mostly) vs setting the config centrally at Fleet (which we do currently).  Current config in our flags file (minus anything sensitive), some of which is already being overridden by Fleet:
    --enroll_secret_path=
    --tls_hostname=
    --host_identifier=
    --enroll_tls_endpoint=/api/v1/osquery/enroll
    --config_plugin=tls
    --config_tls_endpoint=/api/v1/osquery/config
    --config_refresh=3600
    --disable_distributed=false
    --distributed_plugin=tls
    --distributed_interval=60
    --distributed_tls_max_attempts=3
    --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
    --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
    --logger_plugin=tls
    --logger_tls_endpoint=/api/v1/osquery/log
    --logger_tls_period=10
    I'd just like to confirm the recommended approach to do that would be to remove the following settings from our osquery.flags file (and remove the config we are setting at Fleet - the stuff in osquery options / fleetctl get options):
    --config_refresh
    --config_plugin
    --config_tls_endpoint
    Anything else?
    c
    g
    • 3
    • 8
  • z

    zwass

    03/09/2021, 12:55 AM
    Anyone seen errors like
    RocksDB: [WARN] [db/db_impl/db_impl_open.cc:1805] Persisting Option File error: OK
    ? This seems to be perhaps associated with the database getting reset (we notice a new
    instance
    host identifier) right around the time this is logged.
    • 1
    • 1
  • b

    Bacarus

    03/09/2021, 2:04 PM
    Hello everyone, I need help with this query: given an ip, there is a way to have the route to reach that ip with osquery? (something like the tracert command)
    m
    t
    • 3
    • 5
  • r

    Rudra Sarkar

    03/10/2021, 4:58 PM
    Hi, I got a question I found /metrics endpoint is it publically open or can I use this metrics data to show in graph? I am totally new in fleetOSquery
    z
    d
    • 3
    • 3
  • j

    Jams

    03/11/2021, 5:15 PM
    Hi. What are the differences between the file_events and process_file_events table? For example, one table leverages inotify publisher while the latter table requires the Linux audit framework.
    m
    • 2
    • 1
  • a

    Antoinette

    03/11/2021, 9:25 PM
    Hey all is there a delay between when a command is ran and when it gets populated in the
    shell_history
    table?
    z
    • 2
    • 4
  • b

    Bryan Brewer

    03/12/2021, 9:41 PM
    hey trying to troubleshoot a table extension on ubuntu18 it works as expected when I manually load the extension. either via
    osqueryi --extension /etc/osquery/foo.ext
    or
    osqueryi --nodisable_extensions
    and other session
    /usr/bin/python /etc/osquery/foo.ext --socket /root/.osquery/shell.em
    the very same extension autoloads fine on an older box different distro... double checked the configs. they match on working and non-working endpoints. turned on --verbose, but all I see in the non-working logs is
    Copy code
    /var/log/osquery/osqueryd.INFO.20210312-185550.13594:I0312 18:55:58.125411 13630 registry_factory.cpp:107] Extension 37844 registered table plugin foo
    /var/log/osquery/osqueryd.INFO.20210312-203820.19041:I0312 20:38:29.640424 19081 interface.cpp:110] Registering extension (foo, 26890, version=1.0.0, sdk=1.8.0)
    I see it registered
    Copy code
    osquery> select * from osquery_extensions;
    +-------+-------------------+---------+-------------+-------------------------------+-----------+
    | uuid  | name              | version | sdk_version | path                          | type      |
    +-------+-------------------+---------+-------------+-------------------------------+-----------+
    | 0     | core              | 4.5.1   | 0.0.0       | /root/.osquery/shell.em       | core      |
    | 35494 | foo               | 1.0.0   | 1.8.0       | /root/.osquery/shell.em.35494 | extension |
    +-------+-------------------+---------+-------------+-------------------------------+-----------+
    but when auto-loading
    Copy code
    osquery> select * from foo;
    Error: no such table: foo
    just wondering if there's any other pointers out there that I'm not finding in the docs.
    m
    • 2
    • 2
  • a

    Alexander

    03/15/2021, 6:17 PM
    Thank you
    s
    a
    • 3
    • 17
  • d

    defensivedepth

    03/15/2021, 6:36 PM
    Also - sounds like a really neat blog post
    c
    z
    +2
    • 5
    • 21
  • e

    etsang

    03/15/2021, 10:53 PM
    Is osquery able to detect what files/folders in a system are accessed including just a READ? I would like to find out the entire set of files/folders or other assets accessed without knowing the list beforehand. Most other monitor tools you have to know what you want to monitor first. Anyone with example will be appreciated.
    m
    • 2
    • 6
  • j

    Jason Lockwood

    03/16/2021, 6:14 PM
    basically I'm getting an error that osquery can't find conf file, but I'm able to list the contents via powershell in the path listed in the error message. Running this in a 2019 core docker containers.
    m
    • 2
    • 10
  • d

    Dan Achin

    03/16/2021, 8:18 PM
    Has anyone had issues with the osquery client creating new sessions at the same interval as tls logger period? We set ssl_session_reuse to true, but that didn't change the behavior
    t
    • 2
    • 9
  • j

    Juue

    03/17/2021, 6:58 AM
    HI guys, I run “osqueryi --line “SELECT version from osquery_info;” and nothing respond, do you know what is the problem.?
    d
    • 2
    • 1
  • c

    Chris Benninger

    03/17/2021, 4:49 PM
    If I have an expensive query in a view, and I query it multiple times, does it benefit from caching at all?
    t
    • 2
    • 3
  • a

    Ashwin Kawade

    03/18/2021, 11:33 PM
    Hiii, I am struggling add host, Getting error TLS/HTTPS POST request to URI: https://xxxxx:8412/api/v1/osquery/enroll Failed enrollment request to https://xxxxx:8412/api/v1/osquery/enroll (Request error: certificate verify failed) retrying... flagfile.txt
    Copy code
    # Server
    --tls_hostname=xxxxx:8412
    --tls_server_certs=/home/dell/fleet.pem
    
    # Enrollment
    --host_identifier=instance
    --enroll_secret_path=/home/dell/secret.txt
    --enroll_tls_endpoint=/api/v1/osquery/enroll
    
    # Configuration
    --config_plugin=tls
    --config_tls_endpoint=/api/v1/osquery/config
    --config_refresh=10
    
    # Live query
    --disable_distributed=false
    --distributed_plugin=tls
    --distributed_interval=10
    --distributed_tls_max_attempts=3
    --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
    --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
    
    # Logging
    --logger_plugin=tls
    --logger_tls_endpoint=/api/v1/osquery/log
    --logger_tls_period=10
    
    # File carving
    --disable_carver=false
    --carver_start_endpoint=/api/v1/osquery/carve/begin
    --carver_continue_endpoint=/api/v1/osquery/carve/block
    --carver_block_size=2000000
    secret.txt and fleet.pem are at home directory. please help me to resolve this issue. Thank you
    n
    • 2
    • 2
  • z

    zwass

    03/19/2021, 4:55 PM
    https://github.com/osquery/osquery-site/tree/source/src/data/osquery_schema_versions has all the recent-ish versions
    👍 1
    j
    • 2
    • 1
  • m

    Mystery Incorporated

    03/19/2021, 6:51 PM
    Hi, how can I put static data in as a decorator so say I just want to always include the string "TAG81928" as a decorator.
    z
    • 2
    • 2
  • m

    Mystery Incorporated

    03/20/2021, 9:52 AM
    Another question, my osqueryd seems to make a gazillion .info and .warning files. Is there anyway I can stop this happening?
    t
    • 2
    • 5
  • e

    ehrhardt

    03/22/2021, 7:03 PM
    Hey all, the carves table gives the message
    The carves table returns data based on the current user by default, consider JOINing against the users table
    I don't see a uid or shared data field between the carves table and the users table. What can be done to address this message?
    t
    • 2
    • 3
  • e

    etsang

    03/23/2021, 4:36 PM
    I tried select * from file_events; to test out file creation (use touch comand) an dit works; but how can when I jsut READ the very same file again using more or ls; it is not showing the file was accessed as READ. how can I do that?
    n
    z
    • 3
    • 10
  • e

    etsang

    03/23/2021, 5:46 PM
    how can I use pid as a key to query for file_evernts? I want to know which files a known pid has accessed and changed? I am not seeing pid as part of the file_events table returned.
    j
    • 2
    • 6
  • t

    thomaseldredge

    03/23/2021, 9:15 PM
    I'm trying to connect orbit to a fleet server but whenever I run orbit I get the error:
    download target osquery/windows/stable/osqueryd: tuf: unknown target file: osqueryd/windows/stable/osqueryd.exe
    I'm running a fleet preview instance with fleetctl3.9.0 on ubuntu server. The client is a windows10 desktop with osquery4.7.0 installed. I'm using the orbit v0.0.1 release binaries running from an elevated command prompt.
    j
    z
    • 3
    • 3
  • d

    Dan Achin

    03/24/2021, 7:19 PM
    Hello everyone. We are experiencing a very strange issue with some of our osquery clients (both Windows and Mac) where they send massive amounts of data to Fleet - 1 - 3 GB per hour. The bandwidth usage is orders of magnitude more than the size of the events on disk (in logs) and in our backend Splunk infra. We are still investigating, but we were able to get a pcap from a Windows client while it was happening and we see osquery sending each packet 5 - 7 times, which then causes Fleet to respond 5 - 7 times. Has anyone experienced anything like this? I've opened https://github.com/osquery/osquery/issues/7021 and planned to bring it to office hours next week.
    • 1
    • 1
  • b

    Brandon

    03/25/2021, 12:15 AM
    anyone know how to collect dns requests made?
    c
    m
    +3
    • 6
    • 11
  • p

    Prakash Choudhary

    03/26/2021, 3:54 AM
    @here I am new to osquery like to clarify few questions. 1) if there is no change in the table the schedule interval query result will not be added to log file ? 2) is there a way to configure to output each query into a new output file
    p
    s
    • 3
    • 6
  • j

    javuto

    03/28/2021, 6:22 PM
    Hey guys, so while installing osquery in docker images in a M1 laptop, I noticed that the
    ubuntu:20.04
    images identify the architecture as
    aarch64
    instead of
    arm64
    . Does it make sense to duplicate the published package to be both
    arm64
    and
    aarch64
    ?
    t
    • 2
    • 4
  • t

    togal

    03/30/2021, 7:14 AM
    hello,I found a problem and need help: the result of the query on the terminal is normal, but when running through a scheduled task, the result is different from the display on the terminal. Why?
    b
    t
    • 3
    • 3
1...373839...905Latest