Edward04/30/2021, 10:35 PM
would fail (not return any snapshot result) but a query like
select * from os_version
would succeed (returns snapshot result) on a given device when ran at the same time in a query pack?
SELECT * FROM processes
Noah Talerman05/03/2021, 1:27 PM
query eventually appear? Or do you never see the results?
If the results eventually appear, your host may be buffering logs (see the osquery documentation here on remote logging buffering).