I am new to using orbit and osquery. It is a pretty powerful tool. We are exploring using a fleet server to pull data from endpoints using orbit. One thing that we are interested in is active user for a current device. I tried

logged_in_users

example on my mac (https://fleetdm.com/tables/logged_in_users?platformFilter=darwin)

SELECT user, type, tty from logged_in_users WHERE tty='console';

It gives 3 logins for me 2 of type

dead

and one of type

user

. I also get one more entry of type

user

for another user who is not currently using the mac. Is there a way to get the currently active user?

does this provide more expected results?

SELECT * FROM file CROSS JOIN users USING(uid) WHERE path = '/dev/console';

thanks let me try it once this issue is addressed - https://github.com/fleetdm/fleet/issues/22687. I ended my session and now I cannot get back in.

👌 glad to hear it @manoj guglani