we’ve encountred some problems with osquery mass d...
# windows
m
we’ve encountred some problems with osquery mass deployment. (into osquery…wxs file) we added InstallScope=“perMachine” to <Package Comments=“Facebooks opensource host intrusion detection agent” Compressed=“yes” Description=“osquery standalone installer” InstallerVersion=“100” Languages=“1033" Manufacturer=“Facebook” Platform=“x86" InstallScope=“perMachine”/> (we use dark.exe, candle.exe, light.exe for this process) it solved some of our problems related with deployment and also installing, unsintalling, repairing You can try this to see whether solve your problems
r
thanks. We'll give that a try.
m
before we added this code part, the application did not use to appear on add/remove control panel when it deployed through AD
Also before we added this code part, the application size used to increase at every upgrade process when deployed through AD (displayed size on add/remove control panel)
Lastly, as a general osquery issue… application size continues to increase at every repair process also… (right click the application and click repair and see it on add/remove control panel…)
r
That's all good to know. I appreciate it
Did you ever experience osqueryd not starting because of a locked database after upgrading?
m
himm.. I didn’t test it. actually I have it upgraded it succesfuly but didn’t think to check the service. i will check thanks
are you sure that it was because of locked database? or you mean folder permissions
r
Sorry yeah it was permissions
m
actually there shouldn’t be a problem.. because osquery.db folder isn’t uninstalled from the system by uninstall process and this should be valid for upgrade process i think… so although you can’t access to the folder by double click, the System account(osqueryd service is using that account) is able to access to this folder
it is weird if you encounter with this issue
r
Hmm ok I'm pretty sure the permissions caused an issue for us. I'll need to test again to make sure
m
hi, I’m testing the case now. I will inform you (i’m testing the case with the msi file which i built, 3.2.4 and 3.2.6)
upgrade succesful and test OK. after upgrade process, i’m able to query the client and the results pushed to fleet server. No problem with osqueryd service and the osquery.db folder
r
ok great. Thanks for that. After we change the wix file maybe we won't see any issues or it might be environmental