Hi everyone, I wrote a custom table plugin that’s ...
# kolide
Hi everyone, I wrote a custom table plugin that’s working with osqueryi locally, but fleet is failing to query that table (returns 0 results, says 1 failed). What’s the best way to debug this?
Live query
select * from osquery_extensions
to see if your extension is loaded.
I do see it loaded properly
Using that query
I also tried doing the auto table construction option and the results from those tables don’t work either
Does fleet have to know about the schema of these tables somehow?
Nope, fleet just sends the query to osquery
You can use
--verbose --tls_dump
with osquery to see what they are sending each other.
Hm, yea I do get log message for
and the query is correct, but no error messages
I just get the “1 Failure” in the UI
Should the auto tables show up as a result in
They don’t, although the custom extension one does
That I don't know. Maybe try another channel if Fleet is sending the correct query but osquery is not returning results.
Got it, thank you for your help!
What was the issue?