Hi Folks -- I'm wondering where the results of the ad-hoc queries from fleet end up.
For example, I have fleet machines A and B in a cluster, and 100 osquery agents are connected to this cluster. Osquery agents are configured to use the load balancer endpoint which the fleet machines sit behind. I'll assume 50% of the agents will be connected to A, and 50% connected to B. Do both fleet boxes A and B have the same logs of data from the queries run against the osquery agents? Or would each machine have a different set of logs?
Just A Larry
03/27/2020, 10:18 PM
Certainly not a definitive answer as I'm just a novice, but unless you configured fleet to forward logs to AWS, Pub/Sub, etc I would expect them to reside on the filesystem in the /tmp directory. Most likely appended to the file /tmp/osquery_result. I would also only expect to see the results from clients that connected to that cluster node ...but I could be completely mistaken about all of this.
Looking forward to seeing others responses.
03/27/2020, 10:45 PM
Thank you... this is what I assume as well. Maybe @zwass can weigh in? 🙂