I'm having issues with /tmp/osquery_results and /tmp/osquery_status logs being written to, even opening them wide open (777 root:root) after running the fleet.service as root when applying this guidance to a RHEL9 server https://fleetdm.com/docs/deploy/deploy-fleet-on-centos SO I took a different approach with https://www.redhat.com/sysadmin/fleetdm-get-started. Same issue, Fleet works great, but the /tmp/osquery_results and /tmp/osquery_status in the containers aren't being written too either. Anyone seen this?

Hi @Tom Wilburn! Are you seeing any errors in the Fleet server logs?

Not seeing fleet logs.

The Fleet server logs would be written to stdout/stderr by default. The osquery status and results logs are where the associated logs returned from your hosts are stored.

Everything works fine except /tmp/osquery_results and /tmp/osquery_status

Do you have hosts enrolled?

One

Good deal. In that case, we'd at least expect to see some osquery status logs, even if you don't have any scheduled queries set up. Checking the Fleet server logs might give us a clue as to why you don't

The logs are created, but not being written to

Fleet itself doesn't write the server logs to file. Those go to stderr and stdout. In kubernetes, those would be in the pod logs

Problem is CentOS7 is reaching EOL

I'm hoping that those will give us a clue as to why nothing is being written to the osquery log files.

I have one install via Docker

Okay. in Docker, Those log to the container's logs.

On another server, using Centos7 install guidance on fleet.com

Before you try a new setup, I'd like to take a look at the docker-compose file you're using.

Cut-paste from the link at the beginning of this thread

Okay. in that case, the logs I'm talking about now (the Fleet server logs) would not be written to a file.

Yeah, the ones of concern to me is the osquery_result

There are multiple types of logs at play: 1. The Fleet server logs - Those would be in stdout/stderr 2. The osquery_results logs - Those should write to file, but aren't 3. The osquery_status logs - Those should write to file, but aren't

When I restart the service I see output that usually goes to status

What I'd like to see is the Fleet server logs themselves. Those may have errors that would shed light.

I don’t have scheduled queries up on either, but I have ran queries, turned on/off agents, deleted agents, reinstalled agents, etc and nothing is writing. When I get back to my office I will set a scheduled query

Got it. I definitely wouldn't expect anything in osquery_results.

The fear is the problem with status may cause an issue with results. Will confirm hopefully in an hour

Brilliant. I'll be around then.