https://github.com/osquery/osquery logo
d

demonbhao

11/19/2020, 8:51 AM
Hello, I looked up /etc/shadow on the Fleet UI and got a different result than if I went to cat /etc/shadow directly on the target server I'm not sure why querying the Shadow table would query test1111111 but looking at /etc/shadow on the local machine without Test1111111
z

zwass

11/19/2020, 4:47 PM
If you open
osqueryi
in that shell do you get that test result?
d

demonbhao

11/20/2020, 3:37 AM
Yes, open the qsqueryi query and the results will be the same as on the Fleet UI
2 Views