Title
#fleet
s

Steven

08/27/2021, 6:03 PM
Using fleet with OSQuery and queries seem to run correctly for regular OSQuery. However have added the cloudquery extension (https://github.com/Uptycs/cloudquery) to some cloud hosts and results do not come back for the extension, but regular queries still seem to work just fine. Ran a query from the actual host using osqueryi and the extension shows results, for some reason just fails to be reporting results back to fleet. Unsure what would be causing this type of issue, assume if it was a connectivity issue or something all queries would fail, just not queries for the extension.
Tomas Touceda

Tomas Touceda

08/27/2021, 6:10 PM
osqueryi doesn't connect to osqueryd, which is what would be serving the requests to fleet. Silly question, but have you tried restarting osqueryd in the hosts?
s

Steven

08/27/2021, 6:15 PM
correct, was more using osqueryi to make sure the extension it self was working correctly and able to get results. Assume osqueryd would would run the query the same way except also report back to fleet. Yep I did try restarting osqueryd on the effected hosts.
Tomas Touceda

Tomas Touceda

08/27/2021, 6:22 PM
could you share the logs while launching osqueryd with --verbose?
s

Steven

08/27/2021, 6:36 PM
sure thing
6:43 PM
when I run the query I see
Aug 27 18:40:06 cloudquery-928232603593 osqueryd: I0827 18:40:06.309186 28478 tls.cpp:255] TLS/HTTPS POST request to URI: <https://xxxxxxxxxxxx/api/v1/osquery/distributed/write>
Aug 27 18:40:08 cloudquery-928232603593 osqueryd: I0827 18:40:08.738211 28471 tls.cpp:255] TLS/HTTPS POST request to URI: <https://xxxxxxxxxxxx/api/v1/osquery/log>
in the logs, which I would assume be osqueryd trying to return the results ... but no errors on the server
Tomas Touceda

Tomas Touceda

08/27/2021, 6:45 PM
hm, weird, it loads the extension properly
6:49 PM
I'll look into it
6:49 PM
do you see any
ingest-err
on the fleet server logs? also, what version of fleet are you using?
s

Steven

08/27/2021, 6:50 PM
I do not see any errors on the fleet server ... using fleet v4.2.2
6:53 PM
I can see the query being sent on the fleet server and then nothing after that.
Tomas Touceda

Tomas Touceda

08/27/2021, 6:56 PM
do you mind sharing those logs?
s

Steven

08/27/2021, 7:52 PM
I see
Fix bug in which live queries would stop returning results if more than 5 seconds goes by without a result.
in the notes for the 4.2.3 release ... guess I can try upgrading and see if that fixes my issue haha
2:01 AM
that appears to have been the issue ... upgraded and running just fine now ... assuming the extension queries were taking more then 5 seconds
Tomas Touceda

Tomas Touceda

08/30/2021, 1:29 PM
all right, glad 4.2.3 works!