regular osqueryd can get scheduled query packs fro

Question

< nNipsx> regular osqueryd can get scheduled query packs from Fleet Is that what you were asking

nNipsx · Answer

yes

nNipsx · Answer

Now I m trying to do this

nNipsx · Answer

but cant do this

zwass · Answer

Are you getting an error

nNipsx · Answer

No

nNipsx · Answer

i m setup all config for Packs

nNipsx · Answer

but dont recive any result from osquery

zwass · Answer

Do you have the pack targeted to any hosts

nNipsx · Answer

yes

nNipsx · Answer

can you remote my machine and check it again

nNipsx · Answer

i have some lab in my PC

zwass · Answer

No but I can help you continue debugging

nNipsx · Answer

my Version of Kolide fleet is 1 0 6

nNipsx · Answer

and Osquery is 2 11 0

zwass · Answer

Please upgrade fleet to 1 0 8 and try again

nNipsx · Answer

it s okay for schedule query

nNipsx · Answer

can you send me fleet 1 0 8

zwass · Answer

What do you mean it s okay for schedule query

nNipsx · Answer

i m just find 1 0 7

zwass · Answer

nNipsx · Answer

oh thanks let me try this and keep contact with you in this post smile

nNipsx · Answer

Hi can you give me some example for create and get results log with schedule Packs

zwass · Answer

The results go to ` tmp osquery result` on the Fleet server by default

zwass · Answer

This is configurable with ` osquery result log file`

nNipsx · Answer

I m set log file is var log kolide osquery result

nNipsx · Answer

and can you give me some example about create query simple and get log from schedule

zwass · Answer

Try adding a query like `select from time` with an interval of 30 seconds Make sure the pack actually targets some hosts

nNipsx · Answer

and what about shard

zwass · Answer

Typically you would leave shard empty

nNipsx · Answer

Thanks for your support

nNipsx · Answer

i m running success in Linux

nNipsx · Answer

but let me try with Windows

nNipsx · Answer

And now my system running is 106 kolide

nNipsx · Answer

So i want upgrade this version to 108

nNipsx · Answer

How to do that

zwass · Answer

nNipsx · Answer

thanks