I am setting up a new instance of fleet, currently running 4.89.1, and I am trying to get fleet to write out the queries to var/log/fleet/osquery_result.log and I am unable to get it to write out the results. I set this file explicitly to see what was up, as the default in /tmp/osquery_results was not getting created. This makes me think the logs are just not being saved to disk for some reason. I am doing a tls dump of my connection, and the data is getting to fleet, I am just not seeing results being written to the results file. Does anyone have any insight or clues on where to look next? The results file is 0k in size, and I am watching results being sent back to fleet, and I am seeing them in the reports field in fleet too.

Hi Ben! Have you modified the logging configuration at all (https://fleetdm.com/guides/log-destinations#filesystem)?

Yes, I have. I noticed that the /tmp/osquer_results was not being populated before I made changes.

Just to confirm, are you expecting to see live reports or scheduled reports in the result log file? Live report results are not stored on host.

Yes I am expecting scheduled queries, differentials and snapshots to show up there. We have been using fleet for a very long time, and this is our first shift from the 2017 packs to reports, and moving from logging locally on the end points to shipping the logs to the fleetdm server.

There's a couple of areas that I'd be curious to look at here. Do you have time this afternoon or tomorrow to hop on a call?

I might have some time tomorrow afternoon, it is already evening for me here.

I'll send you my scheduling link in a DM.