Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Am i right in thinking that Fleet itself doesn't pull back and store the results of scheduled queries and that if I want access to those results I'll need to ship them to some form of log aggregator?

The results of scheduled queries are stored in results.log

But usually people forward from there to a log aggregator.

On the endpoint filesystem as opposed to the fleet server itself?

You can have the logger be the local filesystem on the endpoints, or use a tls logger which will send the logs to your fleet instance.

Either way you need a way to ship the logs off of your fleet server or the end points.

Thanks, when using the tls logger, whereabouts on the fleetserver are those logs stored?

<https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#filesystem_result_log_file>

Thanks, I'd looked at that page before but clearly didn't read it properly.

No problem - sometimes it is easier to read documentation when you already are familiar with the product

Note that Fleet can now log directly to AWS Firehose, and soon GCP PubSub.