04/15/2022, 11:37 PM
Has anyone seen this problem before where you can run a query locally using osqueryi I get results
SELECT path FROM mdfind WHERE mdfind.query = "kMDItemFSName == '*.ovpn'"
but if I run the same query via fleet and it comes back with nothing? If I just query the path directly on the file table it finds the file so it's something specific about the
table, any ideas? FWIW it seems to work on some computers that are using launcher but I am using orbit if that matters?
12:04 AM
Same goes for this query works in osqueryi but not from fleet
select * from file where path like '/Users/%/Downloads/%.ovpn'
if I remove the wildcards it works fine on both:
where path like '/Users/rhuddleston/Downloads/foo.ovpn'


04/18/2022, 3:20 PM