Hi all Am I the only one having problem with fleetctl upgrad osquery #fleet

Hi all. Am I the only one having problem with 'fle...

Aung

06/26/2024, 5:15 AM

Hi all. Am I the only one having problem with 'fleetctl upgrade-packs'? I have packs with all the schedule frequencies and such. But the output queries of the command gives me all the queries with the interval: 0. I thought it is supposed to be the same frequency value (Every 5 mins or 1 hour) .

Aung

06/26/2024, 5:23 AM

Another problem. If I chose the platform "all" in the queries before export, the command export the result with "plaform: all". But "all" is not one of the options to apply in another fleet deployment. So I cannot apply the exported queries in the fleet. The error is

400 Bad request: query payload verification: query's platform must be a comma-separated list of 'darwin', 'linux', 'windows', and/or 'chrome' in a single string

Dale Ribeiro

06/26/2024, 8:12 PM

Hey @Aung, what version of Fleet are you seeing this on?

Dale Ribeiro

06/26/2024, 8:25 PM

If you don't mind sharing your packs, I can do some testing to see what the behavior is a test environment.

fleetctl get packs --yaml > current_packs.yml

Feel free to DM me the .yml file

Aung

06/27/2024, 2:38 AM

Hi Dale.

Copy code

❯ fleetctl get packs --context prod --yaml > current_pack.yaml
Warning: Version mismatch.
Client Version:   4.51.1
Server Version:  4.21.0

The config.yaml is attached. For now, I have just created a python script to solve the issue. But I think we should also solve the root cause.

current_pack.yaml

Dale Ribeiro

06/27/2024, 11:35 AM

Agreed, thank you. I will find some time to do some testing and get back to you

7 Views

Open in Slack

Previous Next