Title
#kolide
grant seltzer

grant seltzer

04/14/2020, 11:26 PM
Hi everyone, I wrote a custom table plugin that’s working with osqueryi locally, but fleet is failing to query that table (returns 0 results, says 1 failed). What’s the best way to debug this?
zwass

zwass

04/15/2020, 12:06 AM
Live query
select * from osquery_extensions
to see if your extension is loaded.
grant seltzer

grant seltzer

04/15/2020, 12:08 AM
I do see it loaded properly
12:08 AM
Using that query
12:09 AM
I also tried doing the auto table construction option and the results from those tables don’t work either
12:09 AM
Does fleet have to know about the schema of these tables somehow?
zwass

zwass

04/15/2020, 12:10 AM
Nope, fleet just sends the query to osquery
12:10 AM
You can use
--verbose --tls_dump
with osquery to see what they are sending each other.
grant seltzer

grant seltzer

04/15/2020, 12:18 AM
Hm, yea I do get log message for
"NewDistributedQueryCampaign"
12:18 AM
and the query is correct, but no error messages
12:18 AM
I just get the “1 Failure” in the UI
12:20 AM
Should the auto tables show up as a result in
osquery_registry
?
12:20 AM
They don’t, although the custom extension one does
zwass

zwass

04/15/2020, 12:21 AM
That I don't know. Maybe try another channel if Fleet is sending the correct query but osquery is not returning results.
grant seltzer

grant seltzer

04/15/2020, 12:21 AM
Got it, thank you for your help!
zwass

zwass

04/15/2020, 2:37 AM
What was the issue?