Title
#kolide
f

fritz

11/15/2021, 5:03 PM
@sean.cavanaugh i probably will not be able to provide much help as this is in regards to the since-deprecated kolide fleet project, but out of curiosity are you running osqueryi with sudo?
sean.cavanaugh

sean.cavanaugh

11/15/2021, 5:06 PM
will move to the other channel, but no I’m not running osqueryi w/ root
f

fritz

11/15/2021, 5:23 PM
results will differ based on whether osquery is run as root/sudo, since fleet by default runs queries as root, you will need to run osqueryi with sudo to appropriately compare the output of the two.
5:25 PM
https://blog.kolide.com/running-osquery-as-sudo-root-vs-user-4fcfc698c45e this blog article touches on some of those inconsistencies