Hi everyone I think I either have a mistake in my configurat osquery #kolide

Hi everyone! I think I either have a mistake in my...

felix

12/09/2019, 10:32 AM

Hi everyone! I think I either have a mistake in my configuration or a misunderstanding about query packs in fleet in general. So far, none of my packs get executed, even when targeted at all hosts and a 100% shard. Is there something I am missing? Do I need to configure them on the clients as well? Sample pack:

Copy code

apiVersion: v1
kind: pack
spec:
  description: test
  id: 3
  name: test
  queries:
  - description: ""
    interval: 10
    name: Info
    platform: ""
    query: Info
    removed: false
    shard: 100
    snapshot: true
    version: ""
  targets:
    labels:
    - All Hosts

zwass

12/09/2019, 5:31 PM

What does your "Info" query look like?

felix

12/09/2019, 5:32 PM

Just the default select * from osquery_info

zwass

12/09/2019, 5:34 PM

Have you looked at https://github.com/kolide/fleet/blob/7cb45305b2eae4377873cd3b3ad1094a0c8da2fe/docs/infrastructure/faq.md#scheduled-queries?

felix

12/09/2019, 5:37 PM

Yes. I don't think it's a problem with the logging, as I don't see any indication in the fleet status log that it tries to execute the pack. Nor does the client show anything

felix

12/09/2019, 5:39 PM

If I run a query manually in fleet I get the output and see how the server executes it in the log

zwass

12/09/2019, 5:39 PM

So you are able to run a live query against the "All Hosts" label?

felix

12/09/2019, 5:39 PM

Yes

zwass

12/09/2019, 5:42 PM

And you have definitely `fleetctl apply`ed the query and pack? You get this yaml back when you

fleetctl get pack foo

felix

12/09/2019, 5:43 PM

Yes. I added the pack and query via the web interface but I also see it when running fleetctl

zwass

12/09/2019, 5:44 PM

Can you also share the flags/flagfile you are using to start

osqueryd

and the osquery configuration you set in Fleet?

felix

12/09/2019, 5:45 PM

Sure. Will take some time however as I don't have access to the machines at the moment

👍 1

felix

12/10/2019, 8:04 AM

fleetctl get options:

Copy code

apiVersion: v1
kind: options
spec:
  config:
    decorators:
      load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
    options:
      disable_distributed: false
      distributed_interval: 10
      distributed_plugin: tls
      distributed_tls_max_attempts: 3
      logger_plugin: tls
      logger_tls_endpoint: /api/v1/osquery/log
      logger_tls_period: 10
      pack_delimiter: /
  overrides: {}

felix

12/10/2019, 8:05 AM

osquery.conf:

Copy code

{
  // Configure the daemon below:
  "options": {
    "enroll_secret_path": "C:\\Program Files\\osquery\\enroll_secret",
    "tls_server_certs": "C:\\Program Files\\osquery\\certs\\server.pem",
    "tls_hostname": "fleet:443",
    "host_identifier": "hostname",
    "enroll_tls_endpoint": "/api/v1/osquery/enroll",
    "config_plugin": "tls",
    "config_tls_endpoint": "/api/v1/osquery/config",
    "config_refresh": 30,
    "disable_distributed": "false",
    "distributed_plugin": "tls",
    "distributed_interval": 30,
    "distributed_tls_max_attempts": 3,
    "distributed_tls_read_endpoint": "/api/v1/osquery/distributed/read",
    "distributed_tls_write_endpoint": "/api/v1/osquery/distributed/write",
    "logger_plugin": "tls",
    "logger_tls_endpoint": "/api/v1/osquery/log",
    "logger_tls_period": 10,
	"logger_min_stderr": 0,
	"logger_min_status": 0
  }    
}

zwass

12/10/2019, 4:49 PM

What are the flags and flagfile you are starting osqueryd with?

felix

12/10/2019, 4:52 PM

osquery is just started with the conf file, flags is empty

zwass

12/10/2019, 4:59 PM

Ah, so that's likely the issue. You need to set the config plugin at startup using a flag or flagfile. I would move those options you have in

osquery.conf

into a flagfile and then I think it will work.

zwass

12/10/2019, 5:01 PM

(take a look at

osqueryd --help

and you will see that config_plugin is a CLI only flag)

felix

12/10/2019, 5:14 PM

yes! that was it

felix

12/10/2019, 5:14 PM

thank you so much! 🙂

zwass

12/10/2019, 5:43 PM

Nice! Glad to hear it.

2 Views

Open in Slack

Previous Next