https://github.com/osquery/osquery logo
Title
a

Artem

06/01/2021, 12:55 PM
Hi! I ran into live queries issues after 3.12 update. When I try to make requests in UI fleet, they hang for a long time and the result does not appear ( With fleetctl, requests are executed every other time. What could be the problem? How could i debug it? It is not possible to roll back to 3.11 for verification, since 500 error appears in UI fleet on any host page. P.S. the results of all queries from packs are executed and accepted on the server in the file osquery_results. And then they are loaded into Elastic. I have only problems with live queries from fleet UI and fleetctl.
n

Noah Talerman

06/01/2021, 1:15 PM
There seems to be a similar “Fleet UI live query stuck/hangs” issue filed recently on GitHub here: https://github.com/fleetdm/fleet/issues/849 I’m currently working on verifying the issue. How did you discover that the
fleetctl
requests execute every other time?
a

Artem

06/01/2021, 1:39 PM
I am running the same query on the same host from fleetctl. Either the result of query comes, then how in UI Fleet waits for the result for a long time
n

Noah Talerman

06/01/2021, 1:43 PM
Either the result of query comes, then how in UI Fleet waits for the result for a long time
Got it, I will attempt to verify this behavior as well. Thank you