to see the schedule you need to query it from a scheduled qu

Question

to see the schedule you need to query it from a scheduled query

jackjack · Answer

sorry I might have missed your point here Do you mean I need to write another search in the conf file to query what has been scheduled to run

groob · Answer

yes

groob · Answer

you can only get the osqueryd schedule by querying it in the config and reading the logs

jackjack · Answer

oh okay

groob · Answer

the schedule lives in the db and osqueryi never interacts with the db

jackjack · Answer

any idea on why it s not writing to the result file

groob · Answer

try a simpler config file with a frequent query to debug

groob · Answer

there could be a million reasons why but if you re importing a big config it s hard to tell

jackjack · Answer

ok Thank you As always D

groob · Answer

it could be something like you connecting to a TLS server which overrides the config order and points to a different logger

jackjack · Answer

oh Fleet doesn t do that does it

groob · Answer

it does

jackjack · Answer

oh

groob · Answer

if you specified config plugin=tls then your config file is useless

groob · Answer

i you specified config plugin=filesystem then your pack configs in fleet are useless

groob · Answer

pick one

jackjack · Answer

lol It turns out we have both great catch

jackjack · Answer

I don t need `config plugin=tls` for it to talk to fleet right

groob · Answer

right you can choose config plugin=filesystem

jackjack · Answer

+1 thank you

groob · Answer

but note that it means you can t use the fleet packs screens anymore

groob · Answer

you can still use fleet for live queries provided you specified `distributed plugin=tls`

groob · Answer

in your conf file

groob · Answer

labels will also continue to work that way

groob · Answer

also note that fleet has it s own config file format you can use to manage packs if you want to do it outside the UI

groob · Answer

it s an option but there s very little advantages that I know of to using config plugin=filesystem if you re committing to using fleet

jackjack · Answer

True Given that our tunnel is up and reliable smile meanwhile I am just using filesystem to fill the gap once our cloud routing is hardened