Scheduled queries are not returning results from a...
# kolide
h
Scheduled queries are not returning results from all available machines. Also, the queries don't run as per the frequency given. Is anyone else facing the same issue?
z
A few things: 1) Are the queries scheduled in differential mode? They will only return results after changes occur. 2) Osquery will splay the schedule by some amount (default 10% iirc) so the intervals won't be exact. The intervals also won't be exact if the machine goes to sleep or reboots, etc. 3) Try running osqueryd with
--verbose --tls_dump
and looking at the logs. This will let you see what configuration was received from Fleet and when queries are actually running.
h
Yes the queries are differential. I am querying system information table for test. Should it not report all the machines in first time?
running osqueryd with verbose & --tls_dump says that osqueryd is already initialized.
z
All machines should report the first time. I would advise debugging this using a query that will return results every time it runs -- perhaps schedule as a snapshot, or use a differential query against the
time
table. Sounds like you have osqueryd running as a service or some other way? You'll need to stop that before running manually with the additional flags.