wave our org is considering migrating off of Packs and over osquery #fleet

:wave: our org is considering migrating off of Pac...

mbuono

09/18/2023, 7:39 PM

👋 our org is considering migrating off of Packs and over to something more like applying queries and schedules together with

fleetctl

from a file managed in git. Currently our packs each have a target of some class of hosts, eg Linux or Mac, and im looking to replicate the functionality of "Run these queries on these hosts". We don't have access to Teams or anything, but im assuming this is all possible using something like

fleetctl apply

for queries. Where can i find docs on what config keys each "query" object in a file that fleetctl will eventually apply has? I ran

fleetctl upgrade-packs

just to get a sense, and i see

apiVersion

kind

, and

spec

(with some subkeys there), but just wondering if theres an official place i can look through what options i have when configuring queries

mbuono

09/18/2023, 9:45 PM

just finished migrating queries over from packs to queries applied via

fleetctl

, but now i see no result messages being pushed to the output topic (we use pubsub, specified in an env variable) and when i go to

hosts

and look at

Schedule

for one of them, i see nothing. Am i missing some step to ensure that queries are actually scheduled and are pushed to the correct output stream? Fleet also seems to think (when i click "manage automations" to just look around) that the log destination is "filesystem", but when i dump its own config i correctly see

Copy code

osquery:
  ...
  status_log_plugin: pubsub
  result_log_plugin: pubsub

so i dont know why the UI would say that the output plugin is filesystem

mbuono

09/19/2023, 2:50 PM

automations_enabled: true

effectively the way to schedule a query in versions after 4.35? So you set an interval, an optional platform, and then enable automations, and your query will be run on the specified interval and logged to your output plugin that you specified in the fleet config? Or are automations not related to query scheduling, and simply setting interval and platform is enough to schedule a query?

Kathy Satterlee

09/19/2023, 4:46 PM

Here is the documentation for Query config files: https://fleetdm.com/docs/configuration/configuration-files#queries For the issue with the logging destination showing as "filesystem", can you try restarting the Fleet server and pulling the config again? Yes, for a query to be scheduled, you need to have a

interval

set and automations enabled.

3 Views

Open in Slack

Previous Next