Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
b
benbass
10/18/2021, 3:33 PM@Mystery Incorporated Beware that osquery on macOS does not uninstall 4.9.0 when installing version 5.x. SO you have version 5.x in a new place and the 4.9.0 binary stays in /usr/local/bin next to the linked osqueryi and osqueryctl which map back to 5.X in /opt/.
m
Mystery Incorporated
10/18/2021, 3:37 PMThanks yea I think I saw you mention this before so i did my macos ones ok based on your lesson. This was a windows host. It's possible because they change what msi various endpoints give my script pulled the wrong one, I dunno.
b
benbass
10/18/2021, 3:38 PMInteresting, I hadn’t thought about windows hosts. I’ll make sure to pass that on to my windows admin team to make sure they check.
Glad I was able to help you on the mac side. 🙂
👍 1
m
Mystery Incorporated
10/18/2021, 3:49 PMActually it's still happening i found another windows host that doesn't have a pack and it only sees osquery 5.0.1 hmmm
Then it resolved itself so dunno maybe it was a byproduct of what I did before to try fix
b
benbass
10/18/2021, 6:08 PMAwesome, hopefully it won’t crop up again.