Tomas Odehnal
03/28/2022, 3:07 PM--verbose
?
We use osquery with fleetdm and face this file carving issue. After creating file carving live query to carve several files, we obtain the carve ids and check the carve endpoint for results. Sometimes, several of the carve ids don't appear on the carve endpoint until a next carve query is requested. The verbose log on the osquery side just shows a bunch of begin
and block
calls, different number for 'failed' and 'successful' attempt.zwass
03/28/2022, 5:43 PMTomas Odehnal
03/29/2022, 12:24 PMfleetctl query --labels 'All Hosts' --query 'select * from carves'
is that the missing carves are in the SCHEDULED
state. Any idea why that might happen?zwass
03/30/2022, 12:10 AMfleetctl
, but doesn't work if you run the query via API?Tomas Odehnal
03/30/2022, 12:48 PMfleetctl
.
I ran 40 live queries, one fleetctl query
command each 5 seconds. The carving query is the ninth and it contains 34 files to carve.
20 of the carves were stuck in the SCHEDULED
state. Once I ran a simple carving query (one file) to 3 hosts with the stuck queries, all scheduled + the new 3 returned.