https://github.com/osquery/osquery logo
#kolide
Title
# kolide
t

taurian007

04/12/2020, 9:38 PM
will be appreciated
d

DG

04/13/2020, 3:58 PM
Windows Powershell -> Convertfrom-Json (ConvertFrom-Json '{"caller":"publish_results.go:168","err":"rpc error: code = Unknown desc = submitting distributed query results: failed to ingest result: ingesting query kolide_detail_query_network_interface: strconv.Atoi: parsing \"unknown\": invalid syntax","errcode":"","message":"","method":"PublishResults","reauth":false,"results":"[{\"query_name\":\"kolide_label_query_9\",\"status\":0,\"rows\":null},{\"query_name\":\"kolide_label_query_6\",\"status\":0,\"rows\":[{\"1\":\"1\"}]},{\"query_name\":\"kolide_detail_query_network_interface\",\"status\":0,\"rows\":[{\"address\":\"172.31.31.171\",\"broadcast\":\"172.31.31.255\",\"collisions\":\"0\",\"flags\":\"69699\",\"ibytes\":\"566637713\",\"idrops\":\"0\",\"ierrors\":\"0\",\"interface\":\"eth0\",\"ipackets\":\"410793\",\"last_change\":\"-1\",\"link_speed\":\"0\",\"mac\":\"064a24ea91:b0\",\"mask\":\"255.255.240.0\",\"metric\":\"0\",\"mtu\":\"9001\",\"obytes\":\"29204840\",\"odrops\":\"0\",\"oerrors\":\"0\",\"opackets\":\"121800\",\"pci_slot\":\"vif-0\",\"point_to_point\":\"\",\"type\":\"unknown\"}]},{\"query_name\":\"kolide_detail_query_os_version\",\"status\":0,\"rows\":[{\"build\":\"\",\"codename\":\"bionic\",\"major\":\"18\",\"minor\":\"4\",\"name\":\"Ubuntu\",\"patch\":\"0\",\"platform\":\"ubuntu\",\"platform_like\":\"debian\",\"version\":\"18.04.4 LTS (Bionic Beaver)\"}]},{\"query_name\":\"kolide_detail_query_osquery_flags\",\"status\":0,\"rows\":[{\"name\":\"config_refresh\",\"value\":\"300\"},{\"name\":\"distributed_interval\",\"value\":\"10\"},{\"name\":\"logger_tls_period\",\"value\":\"10\"}]},{\"query_name\":\"kolide_detail_query_osquery_info\",\"status\":0,\"rows\":[{\"build_distro\":\"centos7\",\"build_platform\":\"1\",\"config_hash\":\"ca23eeb39a7191a39e45b26d43c771fd3700a9c8\",\"config_valid\":\"1\",\"extensions\":\"active\",\"instance_id\":\"2d802ca0-8bbb-4dde-bef2-3aab5320495a\",\"pid\":\"24928\",\"platform_mask\":\"9\",\"start_time\":\"1586726840\",\"uuid\":\"8f8bd4d8-a6be-4210-a533-6f22696be406\",\"version\":\"4.2.0\",\"watcher\":\"-1\"}]},{\"query_name\":\"kolide_detail_query_system_info\",\"status\":0,\"rows\":[{\"computer_name\":\"ip-172-31-31-171\",\"cpu_brand\":\"Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz\",\"cpu_logical_cores\":\"1\",\"cpu_microcode\":\"0x43\",\"cpu_physical_cores\":\"1\",\"cpu_subtype\":\"63\",\"cpu_type\":\"x86_64\",\"hardware_model\":\"\",\"hardware_serial\":\"\",\"hardware_vendor\":\"\",\"hardware_version\":\"\",\"hostname\":\"ip-172-31-31-171.eu-west-1.compute.internal\",\"local_hostname\":\"ip-172-31-31-171.eu-west-1.compute.internal\",\"physical_memory\":\"1031475200\",\"uuid\":\"8f8bd4d8-a6be-4210-a533-6f22696be406\"}]},{\"query_name\":\"kolide_detail_query_uptime\",\"status\":0,\"rows\":[{\"days\":\"0\",\"hours\":\"15\",\"minutes\":\"11\",\"seconds\":\"45\",\"total_seconds\":\"54705\"}]}]","severity":"info","took":"2.941317ms","ts":"2020-04-12T212731.678535667Z","uuid":"a457454b-8bba-479c-b066-bb0a17aabe96"}').results
Give: query_name status rows ---------- ------ ---- kolide_label_query_9 0 kolide_label_query_6 0 {@{1=1}} kolide_detail_query_network_interface 0 {@{address=172.31.31.171; broadcast=172.31.31.255; collisions=0; flags=... kolide_detail_query_os_version 0 {@{build=; codename=bionic; major=18; minor=4; name=Ubuntu; patch=0; pl... kolide_detail_query_osquery_flags 0 {@{name=config_refresh; value=300}, @{name=distributed_interval; value=... kolide_detail_query_osquery_info 0 {@{build_distro=centos7; build_platform=1; config_hash=ca23eeb39a7191a3... kolide_detail_query_system_info 0 {@{computer_name=ip-172-31-31-171; cpu_brand=Intel(R) Xeon(R) CPU E5-26... kolide_detail_query_uptime 0 {@{days=0; hours=15; minutes=11; seconds=45; total_seconds=54705}}
Or perhaps build being Null
build : codename : bionic major : 18 minor : 4 name : Ubuntu patch : 0 platform : ubuntu platform_like : debian version : 18.04.4 LTS (Bionic Beaver)
So if it is really the error it says -> ingesting query kolide_detail_query_network_interface: strconv.Atoi: parsing \"unknown\". Then thats the result of \"type\":\"unknown\"
Most results i read like Issue 1521 (which is the output "", instead of UNKNOWN - say this was fixed in later versions
t

taurian007

04/13/2020, 5:26 PM
Yes I updated the kolide fleet to latest version and it is fixed now
z

zwass

04/13/2020, 5:40 PM
Which version of Fleet were you using?
3 Views