Ryan
07/14/2020, 3:48 PM/tmp/osquery_result
.
I tried running the same query on-demand against some of the missing hosts and they worked fine, but if I run SELECT * FROM osquery_schedule
they return successfully, but with no records.
Does anyone have any suggestions? Thanks 🙂SELECT * FROM time
query to a single pack and see if that works.
https://github.com/kolide/fleet/blob/master/docs/infrastructure/faq.md#troubleshootingSELECT * FROM osquery_schedule
I get the same result.
What could cause a query pack to fail to be scheduled by osquery on certain nodes?zwass
Ryan
07/16/2020, 9:34 AMMacear
07/16/2020, 9:40 AMRyan
07/16/2020, 11:05 AMMacear
07/16/2020, 11:29 AMRyan
07/16/2020, 4:07 PMzwass
--verbose --tls_dump
on an effected host and see if the host is checking in for configs and Fleet is sending the correct packs to that host. What you describe with the restart of osqueryd has me suspecting perhaps an osquery bug.Ryan
07/16/2020, 4:25 PMzwass
--verbose --tls_dump
in the osquery flagsRyan
07/16/2020, 4:26 PM--verbose
and --tls_dump
in place I don’t see any particular errors, but nor do I see anything that mentions scheduled queries. I can see the distributed queries used for our labels coming in on the affected host, but it doesn’t appear to be receiving any packs to run on a schedule.
I tried upgrading it from 4.3.0
to 4.4.0
and fully restarting it, but no joy sadly. I’m running Fleet version 2.6.0
.
Any other suggestions will be greatly appreciated :)Macear
07/22/2020, 1:56 PMRyan
07/22/2020, 2:15 PMMacear
07/22/2020, 3:29 PMRyan
07/22/2020, 3:30 PMzwass
config_refresh
. You'd want to look for whether the returned config includes the expected packs.Ryan
07/22/2020, 4:40 PMMacear
07/28/2020, 12:57 PMRyan
07/28/2020, 1:02 PM