Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
s
Steven
08/27/2021, 6:03 PMUsing fleet with OSQuery and queries seem to run correctly for regular OSQuery. However have added the cloudquery extension (https://github.com/Uptycs/cloudquery) to some cloud hosts and results do not come back for the extension, but regular queries still seem to work just fine. Ran a query from the actual host using osqueryi and the extension shows results, for some reason just fails to be reporting results back to fleet. Unsure what would be causing this type of issue, assume if it was a connectivity issue or something all queries would fail, just not queries for the extension.
t
Tomas Touceda
08/27/2021, 6:10 PMosqueryi doesn't connect to osqueryd, which is what would be serving the requests to fleet. Silly question, but have you tried restarting osqueryd in the hosts?
s
Steven
08/27/2021, 6:15 PMcorrect, was more using osqueryi to make sure the extension it self was working correctly and able to get results. Assume osqueryd would would run the query the same way except also report back to fleet. Yep I did try restarting osqueryd on the effected hosts.
t
Tomas Touceda
08/27/2021, 6:22 PMcould you share the logs while launching osqueryd with --verbose?
s
Steven
08/27/2021, 6:36 PMsure thing
when I run the query I see
Aug 27 18:40:06 cloudquery-928232603593 osqueryd: I0827 18:40:06.309186 28478 tls.cpp:255] TLS/HTTPS POST request to URI: <https://xxxxxxxxxxxx/api/v1/osquery/distributed/write>
Aug 27 18:40:08 cloudquery-928232603593 osqueryd: I0827 18:40:08.738211 28471 tls.cpp:255] TLS/HTTPS POST request to URI: <https://xxxxxxxxxxxx/api/v1/osquery/log>t
Tomas Touceda
08/27/2021, 6:45 PMhm, weird, it loads the extension properly
I'll look into it
do you see any
ingest-errs
Steven
08/27/2021, 6:50 PMI do not see any errors on the fleet server ... using fleet v4.2.2
I can see the query being sent on the fleet server and then nothing after that.
t
Tomas Touceda
08/27/2021, 6:56 PMdo you mind sharing those logs?
s
Steven
08/27/2021, 7:52 PMI see
Fix bug in which live queries would stop returning results if more than 5 seconds goes by without a result.that appears to have been the issue ... upgraded and running just fine now ... assuming the extension queries were taking more then 5 seconds
✨ 1
t
Tomas Touceda
08/30/2021, 1:29 PMall right, glad 4.2.3 works!
🎉 1