https://github.com/osquery/osquery logo
#kolide
Title
# kolide
g

grant seltzer

04/14/2020, 11:26 PM
Hi everyone, I wrote a custom table plugin that’s working with osqueryi locally, but fleet is failing to query that table (returns 0 results, says 1 failed). What’s the best way to debug this?
z

zwass

04/15/2020, 12:06 AM
Live query
select * from osquery_extensions
to see if your extension is loaded.
g

grant seltzer

04/15/2020, 12:08 AM
I do see it loaded properly
Using that query
I also tried doing the auto table construction option and the results from those tables don’t work either
Does fleet have to know about the schema of these tables somehow?
z

zwass

04/15/2020, 12:10 AM
Nope, fleet just sends the query to osquery
You can use
--verbose --tls_dump
with osquery to see what they are sending each other.
g

grant seltzer

04/15/2020, 12:18 AM
Hm, yea I do get log message for
"NewDistributedQueryCampaign"
and the query is correct, but no error messages
I just get the “1 Failure” in the UI
Should the auto tables show up as a result in
osquery_registry
?
They don’t, although the custom extension one does
z

zwass

04/15/2020, 12:21 AM
That I don't know. Maybe try another channel if Fleet is sending the correct query but osquery is not returning results.
g

grant seltzer

04/15/2020, 12:21 AM
Got it, thank you for your help!
z

zwass

04/15/2020, 2:37 AM
What was the issue?