Gonzalo Saad
10/29/2020, 8:59 PMread
(I saw that in the osqueryd logs) but I do not get the daemon to write
or even show something like this: Executing distributed query: kolide_detail_query_os_version: select * from os_version limit 1
I'm not using the fleet server, doing an experiment haha. I disable_distributed=false
and the result of the /distributed/read
is this one:
{
"queries": {
"dad0f587-abf3-4278-8664-7bc6fa8a8b762": "select * from system_info"
},
"node_invalid": false
}
What could be misconfigured in the daemon to not write data?zwass
Gonzalo Saad
10/29/2020, 9:03 PMzwass
--verbose --tls_dump
on? Have you configured --distributed_tls_write_endpoint
?Gonzalo Saad
10/29/2020, 9:07 PM--verbose
, not using tls_dump
and yes I've configured distributed_tls_write_endpoint
.zwass
tls_dump
will help you see exactly what osquery is reading and writing with the server.Gonzalo Saad
10/29/2020, 9:09 PMzwass