<@U9JGGT91V> regular osqueryd can get scheduled qu...
# kolidez
zwass
06/12/2018, 1:33 PM
@nNipsx regular osqueryd can get scheduled query packs from Fleet. Is that what you were asking?
n
nNipsx
06/12/2018, 1:34 PMyes
nNipsx
06/12/2018, 1:34 PMNow I'm trying to do this
nNipsx
06/12/2018, 1:34 PMbut cant do this
z
zwass
06/12/2018, 1:36 PM
Are you getting an error?
n
nNipsx
06/12/2018, 1:37 PMNo
nNipsx
06/12/2018, 1:37 PMi'm setup all config for Packs
nNipsx
06/12/2018, 1:37 PMbut dont recive any result from osquery
z
zwass
06/12/2018, 1:38 PM
Do you have the pack targeted to any hosts?
n
nNipsx
06/12/2018, 1:38 PMyes
nNipsx
06/12/2018, 1:39 PMcan you remote my machine and check it again ?
nNipsx
06/12/2018, 1:39 PMi have some lab in my PC
z
zwass
06/12/2018, 1:39 PM
No, but I can help you continue debugging
n
nNipsx
06/12/2018, 1:39 PMmy Version of Kolide fleet is 1.0.6
nNipsx
06/12/2018, 1:39 PMand Osquery is 2.11.0
z
zwass
06/12/2018, 1:40 PM
Please upgrade fleet to 1.0.8 and try again
n
nNipsx
06/12/2018, 1:40 PMit's okay for schedule query
nNipsx
06/12/2018, 1:40 PMcan you send me fleet 1.0.8
z
zwass
06/12/2018, 1:40 PM
What do you mean it's okay for schedule query?
n
nNipsx
06/12/2018, 1:40 PMi'm just find 1.0.7
z
zwass
06/12/2018, 1:40 PM
n
nNipsx
06/12/2018, 1:42 PMoh thanks let me try this and keep contact with you in this post 😄
nNipsx
06/12/2018, 2:45 PMHi, can you give me some example for create and get results log with schedule Packs ?
z
zwass
06/12/2018, 2:47 PM
The results go to
/tmp/osquery_resultzwass
06/12/2018, 2:47 PM
This is configurable with
--osquery_result_log_filen
nNipsx
06/12/2018, 2:48 PMI'm set log file is /var/log/kolide/osquery_result
nNipsx
06/12/2018, 2:48 PMand can you give me some example about create query simple and get log from schedule
z
zwass
06/12/2018, 2:49 PM
Try adding a query like
select * from timen
nNipsx
06/12/2018, 2:55 PMand what about shard
z
zwass
06/12/2018, 5:58 PM
Typically you would leave shard empty
n
nNipsx
06/12/2018, 6:18 PMThanks for your support
nNipsx
06/12/2018, 6:18 PMi'm running success in Linux
nNipsx
06/12/2018, 6:18 PMbut let me try with Windows
nNipsx
06/12/2018, 6:24 PMAnd now my system running is 106 kolide
nNipsx
06/12/2018, 6:24 PMSo i want upgrade this version to 108
nNipsx
06/12/2018, 6:25 PMHow to do that
n
nNipsx
06/13/2018, 3:50 PMthanks
3 Views