https://github.com/osquery/osquery logo
#fleet
Title
# fleet
t

toby1knby

01/03/2023, 1:16 PM
Hi guys. I have been reading this post that states:
MacAdmins osquery extension which comes conveniently bundled with Fleet's osquery installers by default
However - when i try to pull from the unified log table in fleetdm, I get a "No platforms (check your query for invalid tables or tables that are supported on different platforms)" Any pointers on what I am doing wrong, or am I just completely missing the point? Thanks in advance for any light you can shed om this.
r

roberto

01/03/2023, 1:32 PM
Hey, this seems to be an UI bug (I can reproduce) if you ignore that message and run the query anyways you should be able to get results. I will create an issue shortly, please let me know if you're able to get past this!
t

toby1knby

01/03/2023, 1:46 PM
😊 Being the coward that I am it never occurred to me to hit "Go".
I can run the query but no joy as it returns errors only. I am just getting started with the example from https://github.com/macadmins/osquery-extension
select * from unified_log where last="1h" and level="debug" and predicate='processImagePath contains "mdmclient"';
r

roberto

01/03/2023, 3:40 PM
are you able to share the errors you get? that might give us a hint
t

toby1knby

01/03/2023, 3:42 PM
Paraphrase (afk): the column "last" does not exist
r

roberto

01/03/2023, 4:01 PM
let me confirm with the team, but I think that since osquery introduced the
unified_log
table natively recently, it might take precedence over the mac admins extension 🤔 here are the available columns: https://github.com/osquery/osquery/blob/91b2c34b5b675e493e79990bcad9f25193eb9f3b/specs/darwin/unified_log.table can you try with some of the examples there? eg:
select * from unified_log where timestamp > -1 and max_rows = 500
@toby1knby got an answer from the team, due to the conflict, we renamed the table provided by the mac admins extension to
macadmins_unified_log
so you can have access to both tables
t

toby1knby

01/03/2023, 6:21 PM
Excellent - thank you very much for the swift follow up. I will get into it further tomorrow.
Yes. Can confirm that examples work. Note: The UI issue we started with is not present once I change
unified_log
to
macadmins_unified_log.