Andrew Zick
12/09/2022, 9:26 AMaugeas
table.
https://osquery.slack.com/archives/C08V7KTJB/p1668118967997209
I’m trying to use FleetDM live queries and additional queries to look at augeas
on a Linux Mint device, but even just SELECT COUNT(*) FROM augeas
returns 0. I’ve had the user install augeas-lenses
locally which has fixed this issue for me before, but it had no effect here. osqueryi
run locally on the machine is able to return results.
Has anyone run into this problem before or have any ideas for potential solutions?
osquery: 5.2.2, Fleet: 4.13.2osqueryi
locally on the same devices
I’ve managed to fix it every time by having the user install the augeas lenses (apt install augeas-lenses
). This is the first time that hasn’t worked 🙁Kathy Satterlee
12/09/2022, 4:11 PMaugeas-lenses
show up there?Andrew Zick
12/09/2022, 5:58 PMSELECT * FROM deb_packages WHERE name LIKE '%augeas%';
Kathy Satterlee
12/09/2022, 6:03 PMSELECT * FROM augeas WHERE path='/etc/ssh/sshd_config';
Andrew Zick
12/09/2022, 6:07 PMKathy Satterlee
12/09/2022, 6:08 PMosqueryi
, but not osqueryd
, but let me dig in to it.Andrew Zick
12/09/2022, 6:10 PMKathy Satterlee
12/09/2022, 6:10 PMAndrew Zick
12/09/2022, 6:12 PMosqueryi
and osqueryd -S
locally on their machine and they both successfully return results, again just for more info.sharvil
12/09/2022, 7:05 PMselect name, value from osquery_flags where name = 'augeas_lenses'
and see what the value of it is?Andrew Zick
12/09/2022, 7:06 PM"host_hostname","name","value"
"radiance","augeas_lenses","/opt/osquery/share/osquery/lenses"
Michal Nicpon
12/09/2022, 7:18 PM/opt/osquery/share/osquery/lenses
actually exists? You mentioned that you installed augeas-lenses
using apt
.Andrew Zick
12/09/2022, 7:19 PMapt
.
I’ll go ask for confirmation from the user.Michal Nicpon
12/09/2022, 7:20 PMAndrew Zick
12/09/2022, 9:14 PM/opt/osquery/share/osquery/lenses
folderSELECT COUNT(*) FROM augeas
😐 which is plenty reasonable.
Works in both live query and in the additional query results that we process + store in a database.
What I changed for unrelated-to-augeas additional query, it changed from:
SELECT COUNT(*) AS result FROM disk_encryption WHERE encrypted = 1
AND name IN (SELECT device_alias FROM mounts WHERE path = '/');
to:
SELECT COUNT(*) AS result FROM mounts WHERE path = '/'
AND device_alias IN (SELECT name FROM disk_encryption WHERE encrypted = 1);
All I did was swap the outer and nested query 😐
I’ll post an update on Monday to confirm whether or not it’s still working. Have a great weekend and thank you for helping me with this!roberto
12/09/2022, 11:34 PMMichal Nicpon
12/14/2022, 5:18 PMAndrew Zick
12/14/2022, 9:19 PM