https://github.com/osquery/osquery logo
Powered by
#kolide
Title
# kolide
h

harveywells

11/26/2018, 5:15 PM
👋 Howdy! We've just converted one of our query packs for use with our Kolide Fleet tls server. We're specifying our label as 
macOS
but when we use 
fleetctl get packs
the platform isn't updated to reflect our target hosts.
r

RPuth

11/26/2018, 5:57 PM
I just tested this personally and it worked just fine. Looking at your snippet I think your targeted label has an extra space.
You have: labels: (space)- macOS While it worked for me with: labels: (nospace)- macOS IE removed the space before 
- macOS
to be inline with 
labels
I believe you're also missing an ID number too. Try something along the lines of: apiVersion: v1 kind: pack spec: id: <some ID number not used> name: <your_pack_name> targets: labels: - <your label>
a

atom

11/26/2018, 6:12 PM
thanks @RPuth we'll give this a shot
hmm tested with spacing and ID's, not fixing the issue
r

RPuth

11/26/2018, 7:02 PM
I just want to make sure, your label is pointing to existing hosts - yes?
a

atom

11/26/2018, 7:16 PM
yep, the label is pointing to 
macOS
which in fleet has 6 hosts currently
r

RPuth

11/26/2018, 7:42 PM
Can you paste the exact yaml file that you're attempting to apply? The one previously pasted has some weird line numbering indentations.
a

atom

11/26/2018, 8:07 PM
yep 1s
Copy code
---
apiVersion: v1
kind: pack
spec:
  id: 2
  name: network
  targets:
    labels:
    - macOS
  queries:
  - description: Retrieves the current status of IP/IPv6 forwarding.
    interval: 3600
    name: ip_forwarding
    query: ip_forwarding
    version: 1.4.5
@RPuth thanks for your help, here's our file
this file had a bunch more queries in it
the label worked after we removed other queries, still debugging
figured out the issue
fleetctl
adds 
labels:null
at the end of the file
remove that and everything is good, thanks for your help @RPuth
2 Views
Powered by