https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi team, on fleet v4.68.0, I noticed that the DB h...
# fleet
s
Hi team, on fleet v4.68.0, I noticed that the DB has the 
query_id
column in the scheduled_queries table set to 
NULL
when I add packs using fleetctl. This column is used by fleet to add stats in the scheduled_query_stats table. Because of this issue, the stats table has incorrect scheduled_query_id column values. Just wanted to confirm if there is a way to provide the ID for the queries in the packs spec? I've added the applied spec and the resulting state of the database in this thread.
👀 1
Applied spec:
Copy code
kind: pack
spec:
  description: 'This is the osquery status pack'
  disabled: false
  id: 31
  name: osquery_status
  queries:
  - description: ""
    interval: 60
    name: osquery_status
    platform: all
    query: osquery_status
    removed: false
    snapshot: true
    version: ""
  targets:
    labels:
    - All Hosts
    teams: null
scheduled_queries
row created with a 
NULL
query id:
Copy code
mysql> select * from scheduled_queries;
+----+---------------------+---------------------+---------+----------+----------+----------+---------+----------+---------+-------+----------------+----------------+-------------+----------+--------------+
| id | created_at          | updated_at          | pack_id | query_id | interval | snapshot | removed | platform | version | shard | query_name     | name           | description | denylist | team_id_char |
+----+---------------------+---------------------+---------+----------+----------+----------+---------+----------+---------+-------+----------------+----------------+-------------+----------+--------------+
|  1 | 2025-10-27 16:38:43 | 2025-10-27 16:38:43 |       1 |     NULL |       60 |        1 |       0 | all      |         |  NULL | osquery_status | osquery_status |             |     NULL |              |
+----+---------------------+---------------------+---------+----------+----------+----------+---------+----------+---------+-------+----------------+----------------+-------------+----------+--------------+
1 row in set (0.00 sec)
stats table referring to a query id of 0 instead of 1:
Copy code
mysql> select * from scheduled_query_stats;
+---------+--------------------+----------------+------------+------------+-------------------+---------------------+-------------+-------------+-----------+-----------+------------+
| host_id | scheduled_query_id | average_memory | denylisted | executions | schedule_interval | last_executed       | output_size | system_time | user_time | wall_time | query_type |
+---------+--------------------+----------------+------------+------------+-------------------+---------------------+-------------+-------------+-----------+-----------+------------+
|       1 |                  0 |              0 |          0 |          4 |                60 | 2025-10-27 16:43:03 |           0 |           0 |        10 |         0 |          0 |
+---------+--------------------+----------------+------------+------------+-------------------+---------------------+-------------+-------------+-----------+-----------+------------+
1 row in set (0.00 sec)
g
Hi Supreeth. I'm still new, and I could very well be entirely wrong with this answer. So, apologies in advance 🙂! I'm using this as a learning opportunity for myself, too. After looking at this for a little while, far as I can tell, there isn't currently a way to provide the 
query_id
for scheduled queries in a pack spec via 
fleetctl
. The 
query_id
would be set when scheduled queries are created via the UI or API, where the query already exists in the 
queries
table and can be referenced by ID. The pack looks to be referencing 
query_name
https://github.com/fleetdm/fleet/blob/f3749ba2534ec696fdc84eeffe533eaeed882bf6/server/datastore/mysql/packs.go#L64 Definitely going to call on the incredible knowledge of @Kathy Satterlee here, though.
s
Got it, thank you @Gray Williams!
✅ 1
9 Views
Open in Slack
PreviousNext
Powered by