Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Has anyone seen this problem before where you can run a query locally using osqueryi I get results `SELECT path FROM mdfind WHERE mdfind.query = "kMDItemFSName == '*.ovpn'"` but if I run the same query via fleet and it comes back with nothing? If I just query the path directly on the file table it finds the file so it's something specific about the `mdfind` table, any ideas? FWIW it seems to work on some computers that are using launcher but I am using orbit if that matters?

Same goes for this query works in osqueryi but not from fleet `select * from file where path like '/Users/%/Downloads/%.ovpn'`

if I remove the wildcards it works fine on both: `where path like '/Users/rhuddleston/Downloads/foo.ovpn'`

This sounds like a permissions issue. See <https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#full-disk-access>.