https://github.com/osquery/osquery logo
Title
g

grant seltzer

08/19/2020, 7:01 PM
Are query packs a recommended way of scheduling queries? I'm confused about the difference between 'Schedule' configuration option and 'Pack' configuration options.
z

zwass

08/19/2020, 7:01 PM
Yeah, typically. Query packs help provide a bit more organization and context, and can also be loaded from separate files.
g

grant seltzer

08/19/2020, 7:02 PM
Interesting, I assume packs came later on
I mentioned in #kolide and #extensions as well as below, but would you expect pack query results to be logged in the same way as scheduled queries?
z

zwass

08/19/2020, 7:03 PM
Yes -- just with the pack name prepended to the query name
g

grant seltzer

08/19/2020, 7:03 PM
Hm - strange. Maybe a bug that it's not working
Thank you!
🍻 1
ah - it was because it wasn't set to a snapshot
🙂