Ronny Nordstrand

12/07/2021, 12:59 PM
Hello. Got a weird one here, osquery is not printing anything to osquery.results.log the scheduled part i want to run does not seem to be executed. When i run the commands manually in osqueryi they work just fine and osqueryctrl config-check also passes. Anybody got any clues? This is my osquery.conf
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "logger_path": "/var/log/osquery",
    "pidfile": "/var/osquery/osquery.pidfile",
    "database_path": "/var/osquery/osquery.db",
    "disable_database": "true",
    "force": "true",
    "verbose": "true",
    "schedule_default_interval": "300",
    "host_identifier": "hostname"
  "schedule": {
    "system_info": {
      "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;"
    "Packages": {
      "query": "select name, version, sha1, install_time, vendor from rpm_packages;"
    "decorators": {
      "load": [
        "SELECT uuid AS host_uuid FROM system_info;",
        "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"


12/07/2021, 1:02 PM
I see no interval statements in schedule block. How it supposed to be executed?
1:03 PM
@Ronny Nordstrand Without an
statements in schedule block, I'd assume that you're relying on distributed execution, is that your case ?

Ronny Nordstrand

12/07/2021, 1:05 PM
i have a default interval in the options field
1:05 PM
and therefor dont need a interval in the actualy query
1:20 PM
oh nvm it started working now


12/07/2021, 4:16 PM
Probably partly because queries are scheduled as differential by default -- they'll only log when there are changes after the first time they log.