https://github.com/osquery/osquery logo
#kolide
Title
# kolide
h

Hudda

07/22/2019, 8:34 AM
Scheduled queries are not returning results from all available machines. Also, the queries don't run as per the frequency given. Is anyone else facing the same issue?
z

zwass

07/22/2019, 5:15 PM
A few things: 1) Are the queries scheduled in differential mode? They will only return results after changes occur. 2) Osquery will splay the schedule by some amount (default 10% iirc) so the intervals won't be exact. The intervals also won't be exact if the machine goes to sleep or reboots, etc. 3) Try running osqueryd with
--verbose --tls_dump
and looking at the logs. This will let you see what configuration was received from Fleet and when queries are actually running.
h

Hudda

07/24/2019, 11:59 AM
Yes the queries are differential. I am querying system information table for test. Should it not report all the machines in first time?
running osqueryd with verbose & --tls_dump says that osqueryd is already initialized.
z

zwass

07/24/2019, 5:06 PM
All machines should report the first time. I would advise debugging this using a query that will return results every time it runs -- perhaps schedule as a snapshot, or use a differential query against the
time
table. Sounds like you have osqueryd running as a service or some other way? You'll need to stop that before running manually with the additional flags.
2 Views