Title
#kolide
sundsta

sundsta

10/11/2019, 5:17 PM
I’ve run into an odd issue, where my scheduled query to retrieve installed packages (
select * from deb_packages;
) is not logging any results. Other queries in the same pack with the same platform targets and schedule return results. Additionally, the
osquery_status
log confirms the query is executing on the intended schedule. Running the same query against the same host in the Fleet UI works. Does anyone have any ideas what may be wrong, or where I can look for more info to troubleshoot this?
6:03 PM
Figured it out. Seems to be a size limit in GCP Pub/Sub. Their documentation indicates a max message size of 10MB though, which my
select * from deb_packages
should be way under.
zwass

zwass

10/11/2019, 6:56 PM
Or is it possible that you scheduled it in differential mode and nothing is changing?
sundsta

sundsta

10/11/2019, 7:47 PM
No, it is snapshot.
9:51 PM
Ah, turns out to be an undocumented ingestion limit on our logging platform. Not an issue with Fleet or PubSub