I’ve had this agent connected a couple of days now...
# fleetd
Daniel Cross
09/07/2023, 1:41 AMI’ve had this agent connected a couple of days now (only agent connected right now, PoCing). Software & Users are not populating. Have I perhaps missed something? Native osquery. Local config is intentional (and is without any scheduled queries or FIM while I diagnose this). I can run Live Queries.
Copy code
❯ sudo cat /etc/osquery/osquery.flags
--database_path=/var/osquery/osquery.db
--host_identifier=instance
--tls_hostname=<http://REDACTED.com|REDACTED.com>
--enroll_secret_path=/etc/osquery/secret.txt
--enroll_tls_endpoint=/api/v1/osquery/enroll
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--config_plugin=filesystem
--logger_plugin=stdout
--disable_carver=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2000000
--disable_watchdog=false
--watchdog_level=0
--schedule_splay_percent=20
--schedule_max_drift=180k
Kathy Satterlee
09/07/2023, 2:12 PMHi @Daniel Cross. Are you seeing any
denylistedd
Daniel Cross
09/07/2023, 11:23 PM0 results for
denyDaniel Cross
09/07/2023, 11:24 PMMy logs pretty much only look like this, maybe I can see if I can bump up the debug level.
Copy code
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"completed","ts":"2023-09-07T23:14:18.349808393Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"pending","ts":"2023-09-07T23:15:18.360457403Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"completed","ts":"2023-09-07T23:15:18.366688741Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"pending","ts":"2023-09-07T23:16:18.377023647Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"completed","ts":"2023-09-07T23:16:18.384154058Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"pending","ts":"2023-09-07T23:17:18.405515506Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"completed","ts":"2023-09-07T23:17:18.412438454Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"pending","ts":"2023-09-07T23:18:18.418417416Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"completed","ts":"2023-09-07T23:18:18.425892124Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"pending","ts":"2023-09-07T23:19:18.435921157Z"}
{"cron":"integrations","instanceID":"HwpCwmLorix6N2fdD5bJBfj0+utsa2dbYkK64Cte+5ndsDE09lEjD+Zkg2+Ad59Yzk7uFlvtxSftfMjfHICV2Q==","level":"info","schedule":"integrations","status":"completed","ts":"2023-09-07T23:19:18.449390645Z"}