Hi guys, I try to figure out why on one of our workstations (windows 10, osquery 3.3.1) running of a scheduled query has stopped. The query is a part of kolide pack, it was scheduled multiple weeks ago and before yesterday was executed on that workstation as expected, and it's still running on other workstations as expected. Another query from the same pack is executed on the problematic workstation without any issues, as well as queries from a list of other packs. The same query I can run from kolide interface on that workstation and see that it returns a result. I would be thankful if you could share any pieces of advice which may help troubleshoot the issue.

how can i update the status_log_file and result_log_file . i want them to be save in

/etc/log/

instead of

/tmp

Is there a way to push YARA config using fleet 1.0.9?

Is there a fleetctl command, or a way using the GUI to drop multiple offline hosts at a time as a form of cleanup?

I think it would be great for UX to add this features to Fleet UI: 1. In "New Query -> Select Targets" allow searching by IP address + allow selecting IP range with CIDR. 2. Search function in Hosts. 3. Add "Last Seen" date to hosts. 4. Grouping hosts. (Labels really suck)

on any query I’ve got output

0%!r(MISSING)esponded (0%!o(MISSING)nline) | 0/0 targeted hosts (0/0 online)

i'm having an issue with distributed queries & kinesis streaming. when I run a distributed query from the kolide UI, osquery does not send the results to the configured kinesis stream (results are successfully returned in kolide, tho). Interestingly, the same osquery instance will run a scheduled pack and those results are sent to kinesis. thoughts?

I actually used valid LetsEncrypt and still had to specify the entire chain. I guess intermediate CAs break it?

If I have an override set in options for a specific OS, do I have to duplicate the default settings that I'm not changing? EX: If I set

distributed_interval

to 10 in the default/main section of the config, do I also need to specify that in my override sections even if I'm not changing that value?

@oneiroi, by the way, groob was right. You don't have to worry about the IP of your MySQL or Redis container changing. It seems you can specify something like : KOLIDE_MYSQL_ADDRESS="mysql1:3306" instead, where "mysql1" is my MySQL container label. No need to do KOLIDE_MYSQL_ADDRESS="172.18.0.3:3306"

quick question: how, in your experience, scalable is Koide. How it will be handling ~20k endpoints, ~200k? What are limitations?

👋 Howdy! We've just converted one of our query packs for use with our Kolide Fleet tls server. We're specifying our label as

macOS

but when we use

fleetctl get packs

the platform isn't updated to reflect our target hosts.

Hello, a new user here experimenting with Kolide and fleetctl in the last few weeks. Have a quick question on how one could query OFFLINE hosts with fleetctl. Is there a good way with fleetctl to get a list of offline hosts? what would be the query look like? Because when you login to UI, you can see ONLINE, OFFLINE, MIA, NEW hosts. I am thinking there is some kind of a query Kolide does to fetch all of these... What is the proper way of doing this through fleetctl ? How about MIA ones ?

./fleetctl query --query 'select * from osquery_info;' --hosts <some_file> ?

any ideas why operator "where" stops working correctly in query like that: "SELECT * FROM users JOIN chrome_extensions USING (uid) where identifier = 'aapocclcgogkmnckokdopfmhonfmgoek' if my osqueryd is running as a service (windows 10, osquery 3.3.1, kolide 2.0.1). The query returns empty result, when there is an extension with that identifier value.

I'm want hide webserver kolide with user, how can i do it ?

The CA that signed it is a local CA, do I need to include the entire chain?

@R0n can you screenshot your browser console when you repro this issue?

I had a few that got halfway through registering and crapped out because I had some permissions issues. The spinning dials for the incoming hosts don't dissapear though

This message was deleted.

Anyone else seeing 502s on the service? I can't view alerts, perform live queries, etc.

not sure if this is the right place to ask; happy to move it somewhere else or open an issue with more detail. Has anyone run into thrift/extensions dying when running a query that drops privileges on linux? I'm using the Go bindings which is why I'm asking here, but think it's related to https://github.com/facebook/osquery/issues/1638. Working on OSX, but my extensions die with

TSocket::read() THRIFT_POLL() Interrupted system call

every time I make a privilege-dropping query on linux. (e.g.

select  * from authorized_keys where uid in (select uid from users);

has anyone got an API/curl example how to execute live query without use of fleetctl? Essentially smth like

fleetctl query --query "select * from osquery_info;" --hosts "All Hosts"

, but with API calls.

@matteo That's basically the "labels" feature. You can target scheduled and live queries to subsets of hosts using labels.

Ohhh that does interest me! Seems like the way to go. 🙂

Is there a way to tell fleetctl when to timeout from waiting for more hosts to a query?

it’s a tool for building osquery pipelines

What are the contents of /etc/osquery/osquery-local.conf?

spinny