Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
d
demonbhao
01/04/2021, 10:13 AMHello, may I ask if I deleted the pack pack on fleet UI, but the log of pack pack query will still be generated? What's the situation?
n
Noah Talerman
01/04/2021, 10:02 PMHi demonbhao. Do you mind walking me through the steps you took from deleting the pack within the Fleet UI to viewing the generated log output?
d
demonbhao
01/05/2021, 6:27 AMOk, on my side, I first logged on to the Fleet UI to pause the pack query, and then I went back to the Fleet server and found that the logs were still sent (Figure 1).Later I deleted the Pack query directly, but the Fleet server still sent the query log.Figure 2 shows the Pack shown on the Fleet UI
Can someone help me please?This problem has been bothering me for a long time and now the log data is contaminated
n
Noah Talerman
01/06/2021, 5:19 PMSorry for the delayed response. I’m brining up this question with the Fleet team
@demonbhao are the logs from the deleted pack still being sent? Sometimes, users encounter a lag after deleted a pack because osquery hasn’t reloaded the configuration (so it knows which queries to run). This lag would result in the logs from deleted packs still being sent before the configuration is reloaded.
d
demonbhao
01/07/2021, 2:32 AMHello, the log is still being sent. It has been going on for several days
Even when I updated Fleet to the latest version 3.5.1, logs continued to be generated in ELK.I don't have this query package in the red flag
n
Noah Talerman
01/07/2021, 5:18 PMAre the two enabled query packs (
General indicatorsossec_rootkitlistening_external_port_V1d
demonbhao
01/08/2021, 2:19 AMMy God, I came to check Elk's log today and found that the deleted pack package is finally not querying
I really appreciate your help
🎉 1
n
Noah Talerman
01/08/2021, 4:24 PMGreat! The issue seems like an odd one to me. Glad it’s resolved. Do you mind adding your last message in the GitHub issue and closing that issue?
d
demonbhao
01/11/2021, 6:31 AMWell, thank you very much
🍻 1