https://github.com/osquery/osquery logo
Title
z

zwass

06/12/2018, 1:33 PM
@nNipsx regular osqueryd can get scheduled query packs from Fleet. Is that what you were asking?
n

nNipsx

06/12/2018, 1:34 PM
yes
Now I'm trying to do this
but cant do this
z

zwass

06/12/2018, 1:36 PM
Are you getting an error?
n

nNipsx

06/12/2018, 1:37 PM
No
i'm setup all config for Packs
but dont recive any result from osquery
z

zwass

06/12/2018, 1:38 PM
Do you have the pack targeted to any hosts?
n

nNipsx

06/12/2018, 1:38 PM
yes
can you remote my machine and check it again ?
i have some lab in my PC
z

zwass

06/12/2018, 1:39 PM
No, but I can help you continue debugging
n

nNipsx

06/12/2018, 1:39 PM
my Version of Kolide fleet is 1.0.6
and Osquery is 2.11.0
z

zwass

06/12/2018, 1:40 PM
Please upgrade fleet to 1.0.8 and try again
n

nNipsx

06/12/2018, 1:40 PM
it's okay for schedule query
can you send me fleet 1.0.8
z

zwass

06/12/2018, 1:40 PM
What do you mean it's okay for schedule query?
n

nNipsx

06/12/2018, 1:40 PM
i'm just find 1.0.7
n

nNipsx

06/12/2018, 1:42 PM
oh thanks let me try this and keep contact with you in this post 😄
Hi, can you give me some example for create and get results log with schedule Packs ?
z

zwass

06/12/2018, 2:47 PM
The results go to
/tmp/osquery_result
on the Fleet server by default
This is configurable with
--osquery_result_log_file
n

nNipsx

06/12/2018, 2:48 PM
I'm set log file is /var/log/kolide/osquery_result
and can you give me some example about create query simple and get log from schedule
z

zwass

06/12/2018, 2:49 PM
Try adding a query like
select * from time
with an interval of 30 seconds. Make sure the pack actually targets some hosts
n

nNipsx

06/12/2018, 2:55 PM
and what about shard
z

zwass

06/12/2018, 5:58 PM
Typically you would leave shard empty
n

nNipsx

06/12/2018, 6:18 PM
Thanks for your support
i'm running success in Linux
but let me try with Windows
And now my system running is 106 kolide
So i want upgrade this version to 108
How to do that
n

nNipsx

06/13/2018, 3:50 PM
thanks