Using fleet with OSQuery and queries seem to run correctly f

Question

Using fleet with OSQuery and queries seem to run correctly for regular OSQuery However have added the cloudquery extension <https github com Uptycs cloudquery> to some cloud hosts and results do not come back for the extension but regular queries still seem to work just fine Ran a query from the actual host using osqueryi and the extension shows results for some reason just fails to be reporting results back to fleet Unsure what would be causing this type of issue assume if it was a connectivity issue or something all queries would fail just not queries for the extension

Tomas Touceda · Answer

osqueryi doesn t connect to osqueryd which is what would be serving the requests to fleet Silly question but have you tried restarting osqueryd in the hosts

Steven · Answer

correct was more using osqueryi to make sure the extension it self was working correctly and able to get results Assume osqueryd would would run the query the same way except also report back to fleet Yep I did try restarting osqueryd on the effected hosts

Tomas Touceda · Answer

could you share the logs while launching osqueryd with verbose

Steven · Answer

sure thing

Steven · Answer

when I run the query I see ```Aug 27 18 40 06 cloudquery 928232603593 osqueryd I0827 18 40 06 309186 28478 tls cpp 255 TLS HTTPS POST request to URI Aug 27 18 40 08 cloudquery 928232603593 osqueryd I0827 18 40 08 738211 28471 tls cpp 255 TLS HTTPS POST request to URI ``` in the logs which I would assume be osqueryd trying to return the results but no errors on the server

Tomas Touceda · Answer

hm weird it loads the extension properly

Tomas Touceda · Answer

I ll look into it

Tomas Touceda · Answer

do you see any `ingest err` on the fleet server logs also what version of fleet are you using

Steven · Answer

I do not see any errors on the fleet server using fleet v4 2 2

Steven · Answer

I can see the query being sent on the fleet server and then nothing after that

Tomas Touceda · Answer

do you mind sharing those logs

Steven · Answer

I see ```Fix bug in which live queries would stop returning results if more than 5 seconds goes by without a result ``` in the notes for the 4 2 3 release guess I can try upgrading and see if that fixes my issue haha

Steven · Answer

that appears to have been the issue upgraded and running just fine now assuming the extension queries were taking more then 5 seconds

Tomas Touceda · Answer

all right glad 4 2 3 works