https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi Community, we are getting the following error i...
# fleet
d
Hi Community, we are getting the following error in osquery status log, when we try to run the following scheduled query 
select * from rpm_packages;
Copy code
","severity":"1","filename":"config.cpp","line":"326","message":"Scheduled query may have failed: pack/Global/rpm_packages","version":"5.9.1","decorations":
When we run it manually in the console, it works! Just doesnt work when its scheduled. These are the options we have: Frequency: 6 hours logging: snapshot Shard: 100 Can someone please help?
can someone please help?
g
What version of Fleet are you running into this on @Darshal Shah?
d
4.28.0
@Grant Bilstad
We really need this query to work for compliance reasons
k
Hey @Darshal Shah! It sounds as though this query may have been running when the osquery watchdog was triggered. A good way to test this is to look at the osquery_schedule table to see if the query is denylisted.
d
Hey @Kathy Satterlee I ran the following query 
SELECT name, query FROM osquery_schedule WHERE denylisted='1';
and got results back two from 2 hosts and both of them had the 
select * from rpm_packages;
under query But we have about 73 online hosts. Does scheduled osquery not return any results even if fails for just one host? and where and how do I add 
--disable_watchdog=true
?
does it go in agent option under command_line_flags?
k
You should see results for hosts that did not fail. The denylist does only last 24 hours by default, so it could be that some hosts have timed out and successfully run the query again, depending on how long ago you saw those errors.
Use caution when totally disabling the watchdog. I'd take a look at all of the denylisted queries first to see if you find any trends there. It could be this query itself that caused the watchdog to trigger, but it could also be another query that was running at the same time. The denylist just applies to anything running at the time the watchdog was triggered.
2 Views
Open in Slack
PreviousNext
Powered by