<https://osquery.slack.com/archives/CBLGAN1HD/p168...
# fleeta
alessandrogario
06/08/2023, 12:13 PM
d
Dr Yann Golanski
06/08/2023, 12:16 PMMore information:
Copy code
√ ; sudo systemctl is-active clamav-freshclam
active
√ ; procs freshclam
PID:▲ User │ TTY CPU MEM CPU Time │ Command
│ [%] [%] │
430207 clamupdate │ 0.0 0.0 00:00:00 │ /usr/bin/freshclam -d --foreground=trueDr Yann Golanski
06/08/2023, 1:42 PMIt would be nice to see what commands fleet uses to find out what goes wrong.
I have the same issue with ssh keys: one of them does not have a password. Which one? ¯\_(ツ)_/¯
k
Kathy Satterlee
06/08/2023, 2:36 PMWhen you refreshed Fleet, did you also run a refetch for the host's information? What happens if you run the policy query manually?
d
Dr Yann Golanski
06/08/2023, 3:12 PMI think so… There's a refesh button in the UI, which is what I used.
How do I run the query manually?
Dr Yann Golanski
06/08/2023, 4:31 PM Copy code
√ ; fleetctl query --query 'SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM processes WHERE (name = 'clamd') OR (name = 'freshclam')) WHERE score == 1;' --labels='All Hosts'
{"host":"<http://nightwatch.neverness.org|nightwatch.neverness.org>","rows":[],"error":"no such column: clamd"}
[…]
✗ 130 ;Dr Yann Golanski
06/08/2023, 4:50 PMMy bad! My shell was not parsing the query properly. This is better:
Copy code
√ ; fleetctl query --query "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM processes WHERE (name = 'clamd') OR (name = 'freshclam')) WHERE score == 1;" --labels='All Hosts'
{"host":"<http://nightwatch.neverness.org|nightwatch.neverness.org>","rows":[]}
100% responded (100% online) | 8/8 targeted hosts (8/8 online)
√ ;Dr Yann Golanski
06/08/2023, 4:51 PMIs that the correct query? 🤔 I pulled it out of the UI.
l
Lucas Rodriguez
06/09/2023, 1:34 PMHi @Dr Yann Golanski!
According to the description, the query:
Checks that both ClamAV's daemon and its updater service (freshclam) are running. Copy code
fleetctl query --query "SELECT * FROM processes WHERE (name = 'clamd') OR (name = 'freshclam');" --labels='All Hosts'd
Dr Yann Golanski
06/09/2023, 1:51 PMclamd