Using fleet with OSQuery and queries seem to run c...
# fleets
Steven
08/27/2021, 6:03 PMUsing fleet with OSQuery and queries seem to run correctly for regular OSQuery. However have added the cloudquery extension (https://github.com/Uptycs/cloudquery) to some cloud hosts and results do not come back for the extension, but regular queries still seem to work just fine. Ran a query from the actual host using osqueryi and the extension shows results, for some reason just fails to be reporting results back to fleet. Unsure what would be causing this type of issue, assume if it was a connectivity issue or something all queries would fail, just not queries for the extension.
t
Tomas Touceda
08/27/2021, 6:10 PMosqueryi doesn't connect to osqueryd, which is what would be serving the requests to fleet. Silly question, but have you tried restarting osqueryd in the hosts?
s
Steven
08/27/2021, 6:15 PMcorrect, was more using osqueryi to make sure the extension it self was working correctly and able to get results. Assume osqueryd would would run the query the same way except also report back to fleet. Yep I did try restarting osqueryd on the effected hosts.
t
Tomas Touceda
08/27/2021, 6:22 PMcould you share the logs while launching osqueryd with --verbose?
s
Steven
08/27/2021, 6:36 PMsure thing
Steven
08/27/2021, 6:36 PMSteven
08/27/2021, 6:43 PMwhen I run the query I see
Copy code
Aug 27 18:40:06 cloudquery-928232603593 osqueryd: I0827 18:40:06.309186 28478 tls.cpp:255] TLS/HTTPS POST request to URI: <https://xxxxxxxxxxxx/api/v1/osquery/distributed/write>
Aug 27 18:40:08 cloudquery-928232603593 osqueryd: I0827 18:40:08.738211 28471 tls.cpp:255] TLS/HTTPS POST request to URI: <https://xxxxxxxxxxxx/api/v1/osquery/log>t
Tomas Touceda
08/27/2021, 6:45 PMhm, weird, it loads the extension properly
Tomas Touceda
08/27/2021, 6:49 PMI'll look into it
Tomas Touceda
08/27/2021, 6:49 PMdo you see any
ingest-errs
Steven
08/27/2021, 6:50 PMI do not see any errors on the fleet server ... using fleet v4.2.2
Steven
08/27/2021, 6:53 PMI can see the query being sent on the fleet server and then nothing after that.
t
Tomas Touceda
08/27/2021, 6:56 PMdo you mind sharing those logs?
s
Steven
08/27/2021, 7:52 PMI see
Copy code
Fix bug in which live queries would stop returning results if more than 5 seconds goes by without a result.Steven
08/28/2021, 2:01 AMthat appears to have been the issue ... upgraded and running just fine now ... assuming the extension queries were taking more then 5 seconds
✨ 1
t
Tomas Touceda
08/30/2021, 1:29 PMall right, glad 4.2.3 works!
🎉 1
15 Views