We are getting empty snapshots for Evented tables like proce

Question

We are getting empty snapshots for Evented tables like process events file events in Security Onion Fleetdm Can anyone suggest some solution

Kathy Satterlee · Answer

Hi < Sheetal Savagaonkar> What version of Fleet are you using Can you give me an example of a query that s effected by this issue

Sheetal Savagaonkar · Answer

Sorry for the delay in responding We are using Fleet 4 10 0 version

Sheetal Savagaonkar · Answer

Sample query will be select from file events

Kathy Satterlee · Answer

That s a fairly beefy query What happens if you try something a little less intense like `SELECT version FROM os version` Are you seeing any errors in the Fleet logs

Sheetal Savagaonkar · Answer

I am able to get the results for the above query I am facing issue only with Evented tables in Osquery

Sheetal Savagaonkar · Answer

Also when I am trying to execute the queries from standalone Osquery with the flagfile and configuration file I am able to get the results But I am not able to get the results in FleetDM in SecurityOnion Also it is not clear from documentation if we can set the flagfile and config file configurations

Sheetal Savagaonkar · Answer

Any solution please

Kathy Satterlee · Answer

I m so sorry about the delay in getting back to you on this Can you upgrade <https fleetdm com docs deploying upgrading fleet upgrading fleet|Fleet to the most current version> then test again and look for any errors in the logs It sounds like there may be issues with timeouts somewhere along the way