Hi I have some packs on fleet and dumping the logs with opti

Question

Hi I have some packs on fleet and dumping the logs with option tls dump=true and verbose I could see the pack queries being executed on the host When I send live query SELECT FROM osquery schedule the result is No results found Do the packs pushed from fleet do not get listed in osquery schedule and if that cases how to check the blacklisted queries

zwass · Answer

Packs pushed from Fleet do get listed in osquery schedule Are you certain your live query is hitting the same host that is executing the scheduled queries Can you see the live query request and response in those tls dump logs

sanjaykcse · Answer

Yes I could see the live query hitting the same host Below is the config enroll secret path= etc osquery cert secret tls server certs= etc osquery cert tls hostname= lt server gt 8080 database path= tmp osquery db pidfile= tmp osquery pid host identifier=uuid force=true config plugin=tls config tls endpoint= api v1 osquery config config tls refresh=30 disable distributed=false distributed interval=3 distributed plugin=tls config tls max attempts=3 distributed tls max attempts=3 distributed tls read endpoint= api v1 osquery distributed read distributed tls write endpoint= api v1 osquery distributed write hash delay=20 pack refresh interval=60 schedule splay percent=20 table delay=20 enroll tls endpoint= api v1 osquery enroll disable watchdog=false watchdog delay=120 watchdog level=1 watchdog memory limit=100 watchdog utilization limit=5 logger plugin=filesystem logger path= tmp

zwass · Answer

This sounds like possibly a bug in osquery If you can provide logs that show the same osquery process 1 receiving a config with a nonempty schedule and 2 returning an empty result set for `select from osquery` then you could file an issue for osquery and it could be investigated

sanjaykcse · Answer

I0304 18 52 42 263559 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 52 53 134891 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 52 53 744874 13256 distributed cpp 121 Executing distributed query kolide distributed query 4 SELECT FROM osquery schedule I0304 18 52 53 745616 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 00 308753 13242 config cpp 1205 Refreshing configuration state I0304 18 53 00 309159 13242 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 04 472676 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 15 224409 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 25 871349 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 30 915606 13242 config cpp 1205 Refreshing configuration state I0304 18 53 30 916021 13242 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 36 478948 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 47 100065 13256 tls cpp 254 TLS HTTPS POST request to URI I0304 18 53 57 731017 13256 tls cpp 254 TLS HTTPS POST request to URI distributed tls max attempts 3 pack delimiter packs normal queries osquery query SELECT FROM osquery info interval 10 platform version removed true shard 1 processes query SELECT FROM processes interval 10 platform version removed true shard 2 node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F decorators load SELECT uuid AS host uuid FROM system info SELECT hostname AS hostname FROM system info options disable distributed false distributed interval 10 distributed plugin tls distributed tls max attempts 3 pack delimiter packs normal queries osquery query SELECT FROM osquery info interval 10 platform version removed true shard 1 processes query SELECT FROM processes interval 10 platform version removed true shard 2 node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries kolide distributed query 4 SELECT FROM osquery schedule queries kolide distributed query 4 statuses kolide distributed query 4 0 messages kolide distributed query 4 node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F decorators load SELECT uuid AS host uuid FROM system info SELECT hostname AS hostname FROM system info options disable distributed false distributed interval 10 distributed plugin tls distributed tls max attempts 3 pack delimiter packs normal queries osquery query SELECT FROM osquery info interval 10 platform version removed true shard 1 processes query SELECT FROM processes interval 10 platform version removed true shard 2 node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F decorators load SELECT uuid AS host uuid FROM system info SELECT hostname AS hostname FROM system info options disable distributed false distributed interval 10 distributed plugin tls distributed tls max attempts 3 pack delimiter packs normal queries osquery query SELECT FROM osquery info interval 10 platform version removed true shard 1 processes query SELECT FROM processes interval 10 platform version removed true shard 2 node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YMnz3q4v5 Q7zSb1Na9i0IUBInAW0F queries node key B4YI0304 18 54 01 665854 13242 config cpp 1205 Refreshing configuration state I0304 18 54 01 666270 13242 tls cpp 254 TLS HTTPS POST request to URI

sanjaykcse · Answer

ubuntu ip 172 31 39 251 ~ $ ls lt tmp osquery result rw r r 1 root root 0 Mar 4 18 31 tmp osquery result I am not getting query pack results on fleet either

sanjaykcse · Answer

I am using osquery version 4 5 1

zwass · Answer

Ah you are setting `shard` to 1 and 2 meaning only 1 or 2 of the hosts that receive the query will actually schedule it

zwass · Answer

So it s most likely that the host just isn t scheduling the query

sanjaykcse · Answer

Yes I had set Shard to 1 changing thisto 0 works Thanks < zwass> Appreciate your help

sanjaykcse · Answer

There two issue here 1 setting shard resolved 2 If pass config option for not sending the logs over TLS logger plugin=filesystem logger path= tmp The demoen stops sending results for scheduled query to fleet Is there any option to just send only result logs to fleet and not the status logs

sanjaykcse · Answer

If logger is configured for TLS and due to any reason fleet is offline the osquery daemon keeps on sending the log results even the TLS connection is not there Error sending status to logger Request error Failed to connect to <http ec2 54 75 78 244 eu west 1 compute amazonaws com 8080|ec2 54 75 78 244 eu west 1 compute amazonaws com 8080> Connection refused After few hours the osqueryd starts crashing to prevent the issue I chose to send the logs to local system But it stops sending results also

sanjaykcse · Answer

would setting buffered log max help preventing such crashes if the it due to growing buffer when not able to set log results over TLS

zwass · Answer

Osquery should not crash If it does that s a bug

sanjaykcse · Answer

Seem I has been hitting the bug <https github com osquery osquery issues 6887> which is fix 15 days back I have cherry picked the changes