Tomas Odehnal03/28/2022, 3:07 PM
? We use osquery with fleetdm and face this file carving issue. After creating file carving live query to carve several files, we obtain the carve ids and check the carve endpoint for results. Sometimes, several of the carve ids don't appear on the carve endpoint until a next carve query is requested. The verbose log on the osquery side just shows a bunch of
calls, different number for 'failed' and 'successful' attempt.
Tomas Odehnal03/29/2022, 12:24 PM
is that the missing carves are in the
fleetctl query --labels 'All Hosts' --query 'select * from carves'
state. Any idea why that might happen?
, but doesn't work if you run the query via API?
Tomas Odehnal03/30/2022, 12:48 PM
. I ran 40 live queries, one
command each 5 seconds. The carving query is the ninth and it contains 34 files to carve. 20 of the carves were stuck in the
state. Once I ran a simple carving query (one file) to 3 hosts with the stuck queries, all scheduled + the new 3 returned.