Hi Folks -- I'm wondering where the results of the ad-hoc queries from fleet end up. For example, I have fleet machines A and B in a cluster, and 100 osquery agents are connected to this cluster. Osquery agents are configured to use the load balancer endpoint which the fleet machines sit behind. I'll assume 50% of the agents will be connected to A, and 50% connected to B. Do both fleet boxes A and B have the same logs of data from the queries run against the osquery agents? Or would each machine have a different set of logs?

Certainly not a definitive answer as I'm just a novice, but unless you configured fleet to forward logs to AWS, Pub/Sub, etc I would expect them to reside on the filesystem in the /tmp directory. Most likely appended to the file /tmp/osquery_result. I would also only expect to see the results from clients that connected to that cluster node ...but I could be completely mistaken about all of this. Looking forward to seeing others responses.

Thank you... this is what I assume as well. Maybe @zwass can weigh in? 🙂

ad-hoc ("live") queries vs. scheduled queries are handled totally differently. Take a look at https://github.com/kolide/fleet/blob/master/docs/infrastructure/faq.md#where-are-my-query-results.

Makes sense... thanks!