https://github.com/osquery/osquery logo
Title
m

marpaia

05/29/2018, 5:43 PM
https://osquery.slack.com/archives/C1XCLA5DZ/p1527334843000014 there are likely no queries scheduled that are emitting results.
l

LogHoarder

05/30/2018, 10:55 AM
@marpala is it just scheduled queries that provide output or do ad-hoc queries output there too? I’ve been trying to save a custom pack but the “Save Query Pack” button is unresponsive.
m

marpaia

05/30/2018, 5:15 PM
all queries provide output, but scheduled queries log to the logger plugin (files or whatever) and ad-hoc queries return results to the distributed write endpoint (which shows up in the UI)
l

LogHoarder

06/07/2018, 12:17 PM
Thanks @marpala. That’s unfortunate but makes sense.
Now if I could only figure out why I can’t save packs 😉
m

marpaia

06/07/2018, 3:11 PM
there’s a few bugs with the 2.0.0-rc1 that i’m working on
so check those out if you haven’t yet
l

LogHoarder

06/08/2018, 12:55 PM
Thanks for your ongoing assistance. Really appreciate it.
m

marpaia

06/08/2018, 3:04 PM
of course, my pleasure