How can we determine which config is bing used by osqury agents. When i run a query about the configs i get the same hash so thats good but i want to know which config is being used.
When i try to calc the hash i dont get same results
12/24/2019, 3:34 PM
You might try
select * from osquery_schedule
to see which queries are scheduled.
12/24/2019, 3:41 PM
Sorry if my question was not clear. I mean when we run
select config_hash from osquery_info;
i wanted to know what is the config that it should represent this hash
12/24/2019, 3:59 PM
If you are using the config from Fleet then the config is generated dynamically for each host based on which labels that host is in and what query packs are targeting that label. There's not a straightforward way to calculate the hash.