https://github.com/osquery/osquery logo
#kolide
Title
j

Jon O'Brien

03/18/2019, 3:19 PM
I have a host which is showing as online in the Kolide Fleet UI but any query against that host just keeps running without returning any results. Any suggestions of where I can start to investigate the issue?
d

defensivedepth

03/18/2019, 4:00 PM
Can you query other online hosts as expected?
j

Jon O'Brien

03/18/2019, 4:01 PM
yes
8 out of 8 hosts are shown online but only 7 of the hosts return any results from a simple query.
d

defensivedepth

03/18/2019, 4:05 PM
You are sure that this particular host should return data for the query? (Use something like this to be sure:
SELECT * FROM osquery_info;
)
j

Jon O'Brien

03/18/2019, 4:06 PM
yes
d

defensivedepth

03/18/2019, 4:12 PM
I would take a look at osqueryd on the host.
3 Views