Bacarus
09/29/2021, 2:58 PMSELECT address, mask, type, friendly_name FROM interface_addresses
scheduled by fleet with this config:
interval(s): 30, platform: All Version: Any, Logging: +/-
And I’ve found those logs:
hostidentifier : "4c4c4544-0051-5310-8032-cac04f595a32"
calendartime : "Mon Sep 27 07:25:53 2021 UTC"
epoch : 1632700800
counter : 0
columns :
mask : "255.0.0.0"
type : "unknown"
address : "127.0.0.1"
friendly_name : ""
action: "added"
--------
hostidentifier : "4c4c4544-0051-5310-8032-cac04f595a32"
calendartime : "Mon Sep 27 06:15:33 2021 UTC"
epoch : 1632700800
counter : 0
columns :
address : "127.0.0.1"
friendly_name : ""
mask : "255.0.0.0"
type : "unknown"
action: "added"
---------
How is it possible that I’ve 2 added of the same row in the same counter and epoch?
This is just an example but I’ve found other logs like that, maybe I didn’t get how scheduled queries works in differential mode.
Each row should have the action alternated, am I wrong?
the behaviour I expected is something like this:
epoch: 1
counter: 0
action: "added"
columns:
address: "10.0.0.1"
...
---------
epoch: 1
counter: 3
action: "removed"
columns:
address: "10.0.0.1"
...
---------
epoch: 1
counter: 5
action: "added"
columns:
address: 10.0.0.1"
...
---------
epoch: 2
counter: 0
action: "added"
columns:
address: "10.0.0.1"
...
---------
epoch: 2
counter: 10
action: "removed"
columns:
address: "10.0.0.1"
...
---------
epoch: 4
counter: 7
action: "added"
columns:
address: "10.0.0.1"
...
Additional info:
I’m using fleet 3.11 and osquery 4.9.0
I also have this issue with other scheduled querieszwass
09/29/2021, 4:10 PMhostIdentifier
?Jocelyn Bothe
09/29/2021, 5:06 PMBacarus
09/29/2021, 7:23 PMzwass
09/29/2021, 7:30 PMBacarus
09/30/2021, 7:06 AM$ ps -e | grep osquery
997 ? 00:20:44 osqueryd
999 ? 00:00:00 osquery-extensi
$ ps -e | grep launcher
788 ? 00:07:04 launcher
$ systemctl --type=service | grep launcher
launcher.launcher.service loaded active running The Kolide Launcher