Hi guys I have been reading this post that states `MacAdmins osquery #fleet

Hi guys. I have been reading this post that states...

toby1knby

01/03/2023, 1:16 PM

Hi guys. I have been reading this post that states:

MacAdmins osquery extension which comes conveniently bundled with Fleet's osquery installers by default

However - when i try to pull from the unified log table in fleetdm, I get a "No platforms (check your query for invalid tables or tables that are supported on different platforms)" Any pointers on what I am doing wrong, or am I just completely missing the point? Thanks in advance for any light you can shed om this.

roberto

01/03/2023, 1:32 PM

Hey, this seems to be an UI bug (I can reproduce) if you ignore that message and run the query anyways you should be able to get results. I will create an issue shortly, please let me know if you're able to get past this!

roberto

01/03/2023, 1:37 PM

Here's the issue: https://github.com/fleetdm/fleet/issues/9158

toby1knby

01/03/2023, 1:46 PM

😊 Being the coward that I am it never occurred to me to hit "Go".

toby1knby

01/03/2023, 1:50 PM

I can run the query but no joy as it returns errors only. I am just getting started with the example from https://github.com/macadmins/osquery-extension

select * from unified_log where last="1h" and level="debug" and predicate='processImagePath contains "mdmclient"';

roberto

01/03/2023, 3:40 PM

are you able to share the errors you get? that might give us a hint

toby1knby

01/03/2023, 3:42 PM

Paraphrase (afk): the column "last" does not exist

roberto

01/03/2023, 4:01 PM

let me confirm with the team, but I think that since osquery introduced the

unified_log

table natively recently, it might take precedence over the mac admins extension 🤔 here are the available columns: https://github.com/osquery/osquery/blob/91b2c34b5b675e493e79990bcad9f25193eb9f3b/specs/darwin/unified_log.table can you try with some of the examples there? eg:

select * from unified_log where timestamp > -1 and max_rows = 500

roberto

01/03/2023, 6:19 PM

@toby1knby got an answer from the team, due to the conflict, we renamed the table provided by the mac admins extension to

macadmins_unified_log

so you can have access to both tables

toby1knby

01/03/2023, 6:21 PM

Excellent - thank you very much for the swift follow up. I will get into it further tomorrow.

toby1knby

01/04/2023, 1:47 PM

Yes. Can confirm that examples work. Note: The UI issue we started with is not present once I change

unified_log

macadmins_unified_log.

Open in Slack

Previous Next