Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello!
After installing Fleet, should we leave the terminal open to ensure that the last command, 'osqueryd --flagfile=flagfile.txt --verbose,' continues to run?

Because we are facing the issue like once the system is turned off and on later, we cant able to see the system in online state in fleet dashboard.

Hey <@U0593U45B1Q>
Here is some info on the Osquery running on hosts;
<https://osquery.readthedocs.io/en/stable/installation/install-macos/>
`This package does *not* install a LaunchDaemon to start osqueryd. You may use the osqueryctl start script to copy the sample launch daemon job plist and associated configuration into place.`

here are the other OS guides too;
<https://osquery.readthedocs.io/en/stable/installation/install-linux/>
<https://osquery.readthedocs.io/en/stable/installation/install-windows/>

Note: if using fleetd to install osquery it will manage updates and keep osquery running in background

We can able to install the fleet !! My question is after installation the osqueryd should be running continuously in backend? means in terminal?

Screenshot 2023-10-24 at 5.01.32 PM.png

this is the osqueryd which is running in background. If we shut down the system and restart again the terminal where  osqueryd was running will be terminated. Then the host/agent goes to offline. Again we have to run the osqueryd command to make the agent to be on online state.

so we dont have any solution, if the system is restarted automatically it shd reflect as online state ??

Hey <@U0593U45B1Q>
fleetd (our Fleet Desktop "agent", osquery is part of the package) should run osquery if installed on endpoints.

Trying to help as much as we can. I could be mis-understanding though, if you are running fleetd on the endpoint and the osquery process is ending can try to look into more for you.

If running plain osquery and need further troubleshooting than the note linked perviously about persistence, the osquery <#C08V7KTJB|general> channel might be able to better support you.