Title
#fleet
Mystery Incorporated

Mystery Incorporated

10/18/2021, 2:22 PM
Has anyone had a host just not pickup a query pack? So like it's been assigned into the MS Windows label, but it's not being given the query pack for windows hosts...
Tomas Touceda

Tomas Touceda

10/18/2021, 2:46 PM
are you running osqueryd with
--versbose --tls_dump
and you're not seeing the pack?
Mystery Incorporated

Mystery Incorporated

10/18/2021, 3:19 PM
I fixed it, it seems that some how the host thought it had both osquery 4.9 and 5.0.1 installed at the same time, dunno why
3:19 PM
But it caused big problems, it was reporting osquery as a no binary on disk process, wouldn't get assigned a pack etc, anyway I totally scrubbed osquery and reinstalled it and that fixed it
3:20 PM
oh and I purged the software, software_cpe and software_cve tables in the db
Tomas Touceda

Tomas Touceda

10/18/2021, 3:54 PM
glad you figured it out!