Hi, I have scheduled these queries in the configu...
# general
z
Hi, I have scheduled these queries in the configuration file as shown below
Copy code
{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "utc": "true"
  },
  "schedule": {
    "system_info": {
      "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
      "interval": 3600
    },
    "high_load_average": {
      "query": "SELECT period, average, '70%' AS 'threshold' FROM load_average WHERE period = '15m' AND average > '0.7';",
      "interval": 900,
      "description": "Report if load charge is over 70 percent."
    },
    "low_free_memory": {
      "query": "SELECT memory_total, memory_free, CAST(memory_free AS real) / memory_total AS memory_free_perc, '10%' AS threshold FROM memory_info WHERE memory_free_perc < 0.1;",
      "interval": 1800,
      "description": "Free RAM is under 10%."
    }
  },
  "packs": {
    "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
    "incident-response": "/usr/share/osquery/packs/incident-response.conf",
    "it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
    "vuln-management": "/usr/share/osquery/packs/vuln-management.conf",
    "hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
    "ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
  }
}
I can see alert in
C:\ProgramData\osquery\log\osqueryd.results.log
as shown below
Copy code
{
  "name": "system_info",
  "hostIdentifier": "DESKTOP-A0NBI09",
  "calendarTime": "Mon Jun 24 16:45:23 2019 UTC",
  "unixTime": 1561394723,
  "epoch": 0,
  "counter": 0,
  "decorations": {
    "host_uuid": "5FCD824C-2A53-11B2-A85C-F0D28B2FA201",
    "username": "LENOVO"
  },
  "columns": {
    "cpu_brand": "Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz",
    "hostname": "DESKTOP-A0NBI09",
    "physical_memory": "8281911296"
  },
  "action": "added"
}
But on wazuh-manager UI, I am looking alert related to osquery error messages as shown in the screenshot. Can anyone please help me what is being missed here?