Bacarus08/04/2021, 10:04 AM
using the command:
--- apiVersion: v1 kind: query spec: name: osquery_schedule description: Report performance stats for each file in the query schedule. query: select name, interval, executions, output_size, wall_time, (user_time/executions) as avg_user_time, (system_time/executions) as avg_system_time, average_memory, last_executed from osquery_schedule; --- apiVersion: v1 kind: query spec: name: osquery_info description: A heartbeat counter that reports general performance (CPU, memory) and version. query: select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid; --- apiVersion: v1 kind: query spec: name: osquery_events description: Report event publisher health and track event counters. query: select name, publisher, type, subscriptions, events, active from osquery_events;
it applies only the first query (osquery_schedule) but not the others. Am I doing something wrong?
fleetctl.exe apply -f queries.yml
Sarah Gillespie08/04/2021, 8:48 PM
flag to your command to dig deeper into what might be going wrong and share what you find with the channel