Hi folks! I’m looking for some suggestions. I’m trying to collect logs (query results) daily, and I want to confirm if my configuration is correct for that setup. Currently, I’m not seeing the logs getting updated in my database. I’m wondering if the issue might be with how I’m inserting the logs. I’m still fairly new and experimenting with this, so any guidance would be really appreciated. Thanks!

# Server Configuration

--tls_hostname= --tls_session_reuse=true # Enrollment Configuration --enroll_tls_endpoint=/ai/enroll/ --enroll_secret_path=/private/var/osquery/enrollment_secret.txt --tls_enroll_max_attempts=3 # Config Plugin --config_plugin=tls --config_tls_endpoint=/ai/config/ --config_tls_refresh=10000 --config_tls_max_attempts=3 # Logger Configuration --logger_plugin=tls --logger_tls_endpoint=/ai/logs/ --logger_tls_period=86400 # Device Identification --host_identifier=uuid # Production settings (disable verbose) --verbose=false "device_info": { "query": "SELECT " "os_version.platform AS platform, " "os_version.build AS build, " "os_version.install_date AS install_date, " "os_version.revision AS revision, " "os_version.name AS os_name, " "os_version.version AS os_version, " "os_version.patch AS patch, " "os_version.platform_like AS platform_like, " "os_version.arch AS arch, " "os_version.extra AS extra, " "os_version.codename AS codename, " "kernel_info.version AS kernel_version, " "kernel_info.device AS kernel_device, " "secureboot.secure_boot AS secure_boot, " "secureboot.secure_mode AS secure_mode, " "secureboot.setup_mode AS setup_mode, " "system_info.uuid AS secureboot_uuid, " "system_info.cpu_type AS cpu_type, " "system_info.cpu_subtype AS cpu_subtype, " "system_info.cpu_brand AS cpu_brand, " "system_info.physical_memory AS physical_memory, " "system_info.cpu_physical_cores AS cpu_physical_cores, " "system_info.cpu_logical_cores AS cpu_logical_cores, " "system_info.cpu_sockets AS cpu_sockets, " "system_info.hardware_vendor AS hardware_vendor, " "system_info.hardware_model AS hardware_model, " "system_info.hardware_version AS hardware_version, " "system_info.hardware_serial AS hardware_serial " "FROM os_version " "LEFT JOIN kernel_info ON 1 = 1 " "LEFT JOIN secureboot ON 1 = 1 " "LEFT JOIN system_info ON 1 = 1;", "interval": 86400, }, priority_order = { "device_info": 0, # Process first "mdm_security_info": 1, # Process second "installed_apps": 2 # Process last } # Sort logs by priority logs_sorted = sorted( logs, key=lambda x: priority_order.get(x.get("name"), 999) ) logger.info(f"[LOGS] Processing {len(logs_sorted)} log entries for user {user_id}") # PROCESS EACH LOG ENTRY for entry in logs_sorted: name = entry.get("name") columns = entry.get("columns", {}) if name == "device_info": _store_device_info( user_id=user_id, vendor_id=vendor_id, node_key=node_key, os_type=os_type, columns=columns, ) elif name == "mdm_security_info": platform = columns.get("platform", os_type) _store_security_info( user_id=user_id, vendor_id=vendor_id, node_key=node_key, platform=platform, columns=columns, ) elif name == "installed_apps": _store_installed_apps( user_id=user_id, vendor_id=vendor_id, node_key=node_key, app_data=columns, ) return Response({"status": "success"}, status=200)

#C08V7KTJB is likely a better place. But... You're setting the tls hostname to blank, but configuring things to use tls. I'm not really sure what's going to happen there.

I removed the TLS hostname before sharing it here. I tested it earlier with the hostname included, and it’s working fine my device is able to connect to the host successfully. Regarding the priority order, in the config I have three SQL queries:

device_info

,

security_info

, and

apps_info

. Since these queries return a large amount of data, I implemented a priority-based insertion logic so the data is processed and stored more efficiently.

You implemented it where? None of that looks like native osquery stuff. You're asking for help debugging osquery, but you're sharing a bunch of something else