https://github.com/osquery/osquery logo
Join Slack
Powered by
Sorry if this has been asked before but is there d...
# kolide
a
Sorry if this has been asked before but is there documentation support for querying custom tables in osquery using fleet? I can query it using osqueryi but fleet fails to produce results.
z
You query them the same way as any other table. If that's not working it is probably because you have not configured osqueryd to include the table.
You can use 
select * from osquery_tables
to check
a
Appreciate your prompt response. I have setup my endpoint using the launcher so I did not configure osqueryd at all
I tried checking osquery_extensions table and it shows there is one connection (I only have one custom table at the moment at the endpoint). The output is ambiguous because it does not show extension name
z
Sounds like your extension is not connected. I'm not sure there is a way to include additional extensions with Launcher unless you modify the source code yourself.
a
Okay so osqueryd configuration is the only option
s
Is this an extension? Launcher starts osqeryd with an 
extension_autoload
file. If 
--extensions_require
is additive, you could use that. I could imagine supporting this in launcher, but I’m not up for writing that PR this week
a
Yes, it is an extension. I will need to use the 
extension_autoload
flag with osqueryd as you and @zwass have pointed out. Thank you both!
🍻 1
s
Yes. Note that this should work through launcher.
Open in Slack
PreviousNext
Powered by