Stephan
01/14/2022, 2:10 PMLucas Rodriguez
01/14/2022, 4:29 PMStephan
01/14/2022, 4:40 PMLucas Rodriguez
01/14/2022, 4:41 PMStephan
01/14/2022, 4:43 PMmysql-community-server 5.7.32-1debian9
Lucas Rodriguez
01/14/2022, 4:43 PMStephan
01/14/2022, 4:46 PMLucas Rodriguez
01/14/2022, 4:47 PMlevel=error
logs? (possibly with aggregating
)Stephan
01/14/2022, 5:29 PMLucas Rodriguez
01/14/2022, 10:50 PMfleet serve
logs go to stderr
actually.Stephan
01/14/2022, 10:52 PMaggregating
and level=error
and the only entry I was able to find is enroll failed: timestamp: 2022-01-14T22:40:37Z: no matching secret found
Executing scheduled query pack...
and the results of that query are in SplunkHas not run
is confusing since these queries are running. But it seems that metadata never makes it back to fleetLucas Rodriguez
01/14/2022, 11:05 PMSELECT *, (SELECT value from osquery_flags where name = 'pack_delimiter') AS delimiter FROM osquery_schedule
(Which is what fleet sends to get the stats from the hosts.)fleet serve
with --logging_debug
to continue troubleshooting.Stephan
01/14/2022, 11:10 PMaverage_memory
and last_executed
. For example, pack/osquery/monitoring-4d172597684da71da8335fe755447e63f25e3107/info-4d172597684da71da8335fe755447e63f25e3107
but when I view that in the UIFLEET_LOGGING_DEBUG
set to true
in an env variable in kube. Is that considered the same as the logging_debug
CLI flag?Lucas Rodriguez
01/14/2022, 11:12 PMexecutions
what value do they return?Stephan
01/14/2022, 11:13 PM1
for those rowsLucas Rodriguez
01/14/2022, 11:15 PMFLEET_LOGGING_DEBUG
is the same as --logging_debug
level=debug
and that have query
or pack
Stephan
01/14/2022, 11:17 PMfleetctl debug connection
in one of the pods which came back clean as well as fleetctl debug errors
Lucas Rodriguez
01/14/2022, 11:18 PMStephan
01/14/2022, 11:20 PMlevel=debug "query" OR "pack"
. Either SELECT *, (SELECT value from osquery_flags where name = 'pack_delimiter') AS delimiter FROM osquery_schedule
or live_query
relatedusers/root-4d172597684da71da8335fe755447e63f25e3107
and a test query called users/root/suid_bin-4d172597684da71da8335fe755447e63f25e3107
. Note that in osquery we have pack_delimiter
set to /
. If I remove the /
in the pack and query name performance data starts working. Is it not possible to use the pack_delimiter
in the names?Lucas Rodriguez
01/17/2022, 12:45 PMpack_delimiter
in the pack and query names. Creating a Github issue right away.Stephan
01/17/2022, 10:42 PMLucas Rodriguez
01/18/2022, 12:51 AM