SK
09/09/2021, 12:14 PMTomas Touceda
09/09/2021, 1:38 PMingest-err
, otherwise, in the host that is not reporting the software, you can run it with verbose logging and see if it's getting the right queries to run--verbose --tls_dump
that might helpSK
09/09/2021, 2:04 PMingest-err
in the logs of fleetTomas Touceda
09/09/2021, 2:30 PMSK
09/09/2021, 7:18 PMRefetch
in the UI, should it also run the query at that moment?I0909 21:05:01.313659 30507 glog_logger.cpp:49] RPM notice: Failed to read auxiliary vector, /proc not mounted?
I0909 21:05:01.313786 30507 glog_logger.cpp:49] RPM notice: Unable to open /usr/lib/rpm/rpmrc for reading: No such file or directory.
I0909 21:05:01.313809 30507 glog_logger.cpp:49] Cannot read RPM configuration files
I0909 21:05:01.314138 30507 yum_sources.cpp:57] File /etc/yum.conf cannot be read
W0909 21:06:01.481489 30507 virtual_table.cpp:961] The atom_packages table returns data based on the current user by default, consider JOINing against the users table
Tomas Touceda
09/09/2021, 7:24 PMfleetctl get config
?SK
09/09/2021, 7:37 PM---
apiVersion: v1
kind: config
spec:
agent_options:
config:
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
options:
carver_block_size: 2000000
carver_compression: true
carver_continue_endpoint: /api/v1/osquery/carve/block
carver_start_endpoint: /api/v1/osquery/carve/begin
config_accelerated_refresh: 300
config_refresh: 600
disable_carver: false
disable_distributed: false
distributed_interval: 60
distributed_plugin: tls
distributed_tls_max_attempts: 3
logger_plugin: tls
logger_tls_compress: true
logger_tls_endpoint: /api/v1/osquery/log
logger_tls_period: 60
pack_delimiter: /
read_max: 524288000
overrides:
platforms:
windows:
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
options:
carver_block_size: 2000000
carver_compression: true
carver_continue_endpoint: /api/v1/osquery/carve/block
carver_start_endpoint: /api/v1/osquery/carve/begin
config_accelerated_refresh: 300
config_refresh: 600
disable_carver: false
disable_distributed: false
disable_events: false
distributed_interval: 60
distributed_plugin: tls
distributed_tls_max_attempts: 3
enable_powershell_events_subscriber: true
enable_windows_events_publisher: true
enable_windows_events_subscriber: true
events_optimize: true
logger_plugin: tls
logger_tls_compress: true
logger_tls_endpoint: /api/v1/osquery/log
logger_tls_period: 60
pack_delimiter: /
read_max: 524288000
windows_event_channels: System,Application,Setup,Security,Microsoft-Windows-PowerShell/Operational
host_expiry_settings:
host_expiry_enabled: true
host_expiry_window: 2
host_settings:
enable_host_users: true
enable_software_inventory: true
server_settings:
enable_analytics: false
live_query_disabled: false
server_url:
vulnerability_settings:
databases_path: /tmp/vulndbs
Tomas Touceda
09/09/2021, 7:39 PM/osquery/distributed/read
SK
09/09/2021, 7:42 PMfleet_detail_query_users:
and other queries also, only not the software oneTomas Touceda
09/09/2021, 8:26 PMSK
09/09/2021, 8:38 PMTomas Touceda
09/09/2021, 9:12 PM