Analyzing our fleetdm status events at Splunk we just notice

Question

Analyzing our fleetdm status events at Splunk we just noticed that software inventory queries are not working fine since osqueryd running as admin root needs `consider JOINing against the users table`

Sarah Gillespie · Answer

< spookerlabs> thanks very much for sharing this Would you mind filing a

spookerlabs · Answer

I ll double check latest version since Im using Fleet 3 11 0 5 g6491a25c and not latest one

spookerlabs · Answer

If I confirm I ll open an issue

Noah Talerman · Answer

< spookerlabs> the issue you ve reported will likely not be resolved in the latest release of Fleet 3 13 0 However the Fleet team would like to resolve this in the upcoming release Do the software inventory queries run successfully If so is the issue that they create unnecessary entries due to these osquery warnings in Splunk

spookerlabs · Answer

Hi there Looking into Hosts Software for example Ubuntu Desktop it shows online types `Packages Python` `Package deb ` and `Package APT ` Nothing related to browsers extensions

spookerlabs · Answer

Another point is there a restriction to run on only some Labels Because I have some Linux Mint in my fleet and Software Inventory didn t return anything