I'll also add that /var/log/osquery/result.log is world read writable and selinux is disabled (rhel7)

@stefanmaerz Fleet is intended to work just fine behind an LB, so please let us know if you encounter any problems. I believe many folks are using it this way.

hey @clong, cool to see you here. It's your DetectionLab that got me here actually 🙂

@Kemal consider creating a label that selects a few specific hosts with

select 1 from osquery_info where hostname in ('foo', 'bar', 'baz')

, then target your pack to that label.

Yeah it depends on the checkin interval

access what?

Can anyone confirm if kolide osquery launcher is pre-installed in redhunt VM itself or need to install separately.

you have to forward them to your own integration

@groob Is there an ETA for Windows Launcher support?

@defensivedepth any reason you're looking to run 3.2 right now?

Scheduled queries continue executing and logs are buffered on the client until it has connectivity with the server again

we should maybe add some of the new configuration options in a migration?

@Dave we do plan to add windows support to launcher, but no ETA on that. You can totally use fleet with plain osqueryd which has full windows support.

@zwass Got my server terminating SSL thanks for your help!

@Edwin there’s an import script... try searching in this channel. I’m on mobile so tricky to find.

Hopefully a quick win, but the api/v1/osquery/ endpoint, can that issue commands/searches to individual osquery instances?

Hi everybody, I have the same problem with result log file too. Everything is working fine through web interface and either through redis but there is no entry in result log file.

Please if someone knows how to repair this, let me know

https://osquery.readthedocs.io/en/stable/development/pubsub-framework/ does kolide fleet have any support for events-based tables?

Do you have any documentation on the cloud product and a roadmap?

is there a way to manually reset the password in the database?

hi some basic commands like "select * from processes" and "select * from users" don't return any result, any ideas ?

I wasn't able to run curl in my Windows, any alternative ?

@jackjack what is your Server URL set to in fleet?

@munemunk3y https://osquery.slack.com/archives/C1XCLA5DZ/p1522942501000155

@pvirani when you use the

POST /v1/queries

endpoint you will create a query and get back an HTTP response. that response will contain the query you just created and have the ID When you’re then adding queries to pack you should use the ID you got from creating your query to add it to the pack

wonder what the best way of triggering that is? i have fleet running in fargate

@mari0d I replied in the issue

another question please @groob, I still have trouble in understand what do you mean by signed the certificate, is the 3 commands below should do the trick or I need to do other stuff not mentionned in the fleet-on-ubuntu.md

$ openssl genrsa -out /tmp/server.key 4096
$ openssl req -new -key /tmp/server.key -out /tmp/server.csr
$ openssl x509 -req -days 366 -in /tmp/server.csr -signkey /tmp/server.key -out /tmp/server.cert

@zwass even put up a changelog last week