Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Screenshot 2023-09-15 at 10.38.50 AM.png

hey, i recently updated our fleet server, and re-applied our query packs, but the frequency column is still blank for everything. any ideas why that is? the queries are definitely executing and logging properly

not sure if it’s relevant, but our query packs are in .yml format. i don’t see much documentation using that format

Could you share an example from your config? are the query packs from the 2017 format?

i believe so yea
```---
apiVersion: v1
kind: pack
spec:
  name: osx
  targets:
    labels:
    - macOS
  queries:
  - description: report active processes without a corresponding binary on disk
    interval: 3600
    name: process-without-binary-on-disk
    query: process-without-binary-on-disk
---
apiVersion: v1
kind: query
spec:
  description: report active processes without a corresponding binary on disk
  name: process-without-binary-on-disk
  query: &gt;
    SELECT
      *
    FROM processes
    WHERE on_disk = 0;```
going to try converting them!

hey <@U04UW5JJ1C4>, i ran `upgrade-packs` and there may be a bug. the platform is missing (somewhat understandable) and the intervals are all set to 0 e.g.
```---
apiVersion: v1
kind: query
spec:
  automations_enabled: false
  description: |-
    report active processes without a corresponding binary on disk
    (converted from pack "osx", query "process-without-binary-on-disk")
  interval: 0
  logging: ""
  min_osquery_version: ""
  name: osx - process-without-binary-on-disk - Sep 18 15:12:30.835
  observer_can_run: false
  platform: ""
  query: |-
    SELECT
      *
    FROM processes WHERE on_disk = 0;
  team: ""
---```

so i had the same issue, im wondering if this line explains why there was no scheduling for me,
```For any "Packs" targeting labels or individual hosts, a global query was written without scheduling features enabled.```
So i guess if all our packs are set to run on a certain label (eg "Linux Hosts"), the `upgrade-packs` command will take those queries and make global versions of them, and then i just have to manually go in and enable `interval` (since for me, `platform` is already set, and i assume that `interval == 0` means a global query will not be scheduled)?

ahh yep that’s it. i had forgotten we also used labels to target different host groups