Title
#macos
l

Luis Gomez

05/26/2021, 7:15 AM
Does anybody know why I could be having an issue where all entries in
osquery_schedule
have a
last_executed = 0
? I have enabled the osx-attack pack but no queries seem to be running, I left the default Intervals and I'm using filesystem logging. If this is not the right place to ask this let me know where thanks! 😃
7:16 AM
I'm also wondering what's the best way to debug this.
a

allister

05/26/2021, 8:44 AM
the daemon is running?
8:44 AM
what is configuring the schedule, is it a local conf or over TLS from a server?
l

Luis Gomez

05/26/2021, 8:50 AM
it's all in my local computer
8:50 AM
daemon is running
8:51 AM
➜  ~ sudo osqueryctl status
com.facebook.osqueryd is running. pid: 10799
a

allister

05/26/2021, 8:52 AM
what's the interval on the attacks pack?
8:54 AM
I'm seeing every hour for a lot of them, has it output logs multiple times?
8:55 AM
actually these are all differentials
8:56 AM
I saw the same thing you did the first time I did an adhoc run, but now a few weeks after scheduling some snapshots/differentials I get unix timestamps for that key
l

Luis Gomez

05/26/2021, 8:57 AM
is it normal that in the
osquery_schedule
table
8:58 AM
all entries have
last_executed = 0
?
8:58 AM
I was expecting not to find log entries in
osqueryd.results.log
which is fine
8:58 AM
specially for the osx-attack pack
8:58 AM
but I was looking for a confirmation that the queries where running
8:59 AM
the interval is 3600 seconds in all the queries of the pack by default
8:59 AM
I also tried to lower one of the queries' interval to 120 seconds to see if that was it
8:59 AM
but no luck so far
a

allister

05/26/2021, 9:00 AM
when it has nothing to report is has nothing to report
l

Luis Gomez

05/26/2021, 9:00 AM
of course
9:00 AM
but should not appear somewhere that the query was executed by the scheduler?
a

allister

05/26/2021, 9:01 AM
I'm not sure how that field gets evaluated if it has no results, but I also don't think like a security person, I think like an inventory/auditing person - I'm mostly running snapshots
l

Luis Gomez

05/26/2021, 9:04 AM
so my question is mostly how to find out when a certain query was executed by the scheduler, cause I thought the
last_executed
column in the
osquery_schedule
was doing that but not sure anymore
9:05 AM
I do have default scheduled query in the conf which adds results on the log
9:05 AM
system_info one
9:05 AM
but that also shows last_executed = 0
a

allister

05/26/2021, 9:49 AM
has it been running for longer than ~24 hours?
9:49 AM
I mean that shouldn't make a difference, but
l

Luis Gomez

05/26/2021, 10:11 AM
yeah
zwass

zwass

05/26/2021, 3:08 PM
Are you running
osquery_schedule
in
osqueryi
?
l

Luis Gomez

05/26/2021, 4:02 PM
the query yes
4:03 PM
SELECT * from osquery_schedule WHERE last_executed > 0 ;
running this query in
osqueryi
gives nothing
4:06 PM
is it because it's a virtual db?
4:08 PM
I thought maybe it would connect to the RocksDB for this stuff
4:08 PM
but I'm new to osquery so it's still unclear to me 🙂
zwass

zwass

05/26/2021, 4:21 PM
This is a common misconception
4:21 PM
Both processes cannot connect to the same DB, so osqueryi has no access to the schedule info
4:22 PM
However, there is a new functionality that can be helpful with this. See https://twitter.com/fleetctl/status/1387376047516053508
l

Luis Gomez

05/26/2021, 4:32 PM
oh nice!
4:32 PM
thanks for the clarification @zwass!
zwass

zwass

05/26/2021, 4:37 PM
(typically you want to schedule a query for the
osquery_schedule
table, but that new
.connect
command is a good option for ad-hoc analysis)
l

Luis Gomez

05/26/2021, 4:44 PM
makes sense, ad-hoc is good mostly for checking quickly that the query runs as it should