<@UFJ7BR2MA> i probably will not be able to provid...
# kolide
@sean.cavanaugh i probably will not be able to provide much help as this is in regards to the since-deprecated kolide fleet project, but out of curiosity are you running osqueryi with sudo?
will move to the other channel, but no I’m not running osqueryi w/ root
results will differ based on whether osquery is run as root/sudo, since fleet by default runs queries as root, you will need to run osqueryi with sudo to appropriately compare the output of the two.
👍 1
https://blog.kolide.com/running-osquery-as-sudo-root-vs-user-4fcfc698c45e this blog article touches on some of those inconsistencies