Has anyone come across a scenario where all and/or some of the queries in enabled pack do not run? But when the query that hasn't run is run one off, it returns successfully?
k
Kathy Satterlee
08/24/2022, 9:07 PM
Hi, @Shend Saliaga! What version of Fleet are you running?
s
Shend Saliaga
08/24/2022, 9:13 PM
Sorry the most important detail I left out, im using the following image:
fleetdm/fleet:v4.11.0
k
Kathy Satterlee
08/24/2022, 9:34 PM
Is there any indication in the osquery logs that the queries are running? Any errors either in the Fleet server logs or the javascript console/network tab in the browsers? It would be interesting to know if it's an issue with the UI displaying data properly vs the query not executing.
s
Shend Saliaga
08/24/2022, 9:56 PM
I do recall an issue with Kolide Fleet where queries run one off would not display results. I dont believe this is the case however, since checking our database I dont see entries for queries that are reporting