Nico
07/03/2019, 8:35 PMselect * from time
running every 30s but I don't see any results from that. I can run manual queries and see the result in the UI fine, but nothing in firehose. When I do that I see Executing distributed query: kolide_distributed_query_45: SELECT * FROM time
sent to firehose but no actual result.
Here are the fleet env vars I'm using (excluding mysql and redis). I did a manual write to the stream with the same creds with awscli successfully (The role has permission to describe and put record batch).
export KOLIDE_LOGGING_DEBUG=true
export KOLIDE_FIREHOSE_REGION=${KOLIDE_CONFIG_FIREHOSE_REGION}
export KOLIDE_FIREHOSE_RESULT_STREAM=${KOLIDE_CONFIG_FIREHOSE_RESULT_STREAM}
export KOLIDE_FIREHOSE_STATUS_STREAM=${KOLIDE_CONFIG_FIREHOSE_STATUS_STREAM}
export KOLIDE_OSQUERY_RESULT_LOG_PLUGIN=firehose
export KOLIDE_OSQUERY_STATUS_LOG_PLUGIN=firehose
I'm using firehose with elasticsearch and s3 backup, and there is no failed delivery files in s3.
What is the best way to debug this issue? I don't see any errors in the fleet output itself.
Thanks!zwass
07/03/2019, 8:49 PMNico
07/03/2019, 8:50 PM--tls-hostname XXX
--logger_plugin=tls
--config_plugin=tls
--verbose
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_tls_endpoint=/api/v1/osquery/config
--enroll_secret_env=OSQUERY_ENROLL_SECRET
sundsta
07/03/2019, 9:16 PMNico
07/03/2019, 9:19 PMJul 03 21:17:46 ip-172-23-6-159 osquery.sh[1019]: I0703 21:17:46.221714 1263 tls.cpp:240] TLS/HTTPS POST request to URI:
sundsta
07/03/2019, 9:21 PM{"hostIdentifier":"FB2C3611-EA6B-C10B-3611-3C4CF096B325","calendarTime":"Wed Jul 3 21:17:52 2019 UTC","unixTime":"1562188672","severity":"0","filename":"scheduler.cpp","line":"100","message":"Executing scheduled query pack/events/user_events: SELECT * FROM user_events \nWHERE time < DATE('now') - 300","version":"3.3.2","decorations":{"host_uuid":"FB2C3611-EA6B-C10B-3611-3C4CF096B325","hostname":"REDACTED.local"}}
Nico
07/03/2019, 9:21 PMsundsta
07/03/2019, 9:22 PMNico
07/03/2019, 9:22 PMsundsta
07/03/2019, 9:22 PMNico
07/03/2019, 9:23 PMzwass
07/03/2019, 10:05 PMNico
07/04/2019, 8:18 AM