Hello helpful folks I m running into a super weird issue and

Question

Hello helpful folks I m running into a super weird issue and not sure where the breakdown maybe I have a test host enrolled into Fleet The scheduled queries are running perfectly fine on the host but the results don t show up in ` var log osquery osqueryd results log` on the host see the example log line from it below ``` name pack osquery monitoring schedule hostIdentifier ip 172 31 55 24 calendarTime Wed Jan 11 19 46 37 2023 UTC unixTime 1673466397 epoch 0 counter 0 numerics false decorations host uuid ec2fb435 c38c 9e86 d043 106a4c7ec832 hostname ip 172 31 55 24 us west 2 compute internal columns average memory 0 avg system time avg user time executions 0 interval 86400 last executed 0 name pack it compliance iptables output size 0 wall time 0 action added ``` On the Fleet Webserver `cat osquery status f` shows the last query execution to have happened in August 2022 scream cat ``` hostIdentifier ip 172 31 23 127 calendarTime Fri Aug 26 18 54 26 2022 UTC unixTime 1661540066 severity 2 filename scheduler cpp line 118 message Error executing scheduled query pack osx attacks OSX Mughthesec no such table launchd version 5 2 2 decorations host uuid EC2C455A F709 B975 ADA7 C33DE9F7EABA hostname ip 172 31 23 127 us west 2 compute internal ``` Where do I even begin debugging

Kathy Satterlee · Answer

Hey < pvirani> Can you verify the logger plugin by running this query against that test host ```SELECT value FROM osquery flags WHERE name = logger plugin ```

pvirani · Answer

hostname value ip 172 31 55 24 us west 2 compute internal filesystem

pvirani · Answer

^ < Kathy Satterlee>

pvirani · Answer

that also sounds wrong because when I launched the webserver I d spun it up with the following flags ``` name FLEET OSQUERY RESULT LOG PLUGIN value firehose name FLEET FIREHOSE REGION value us west 2 name FLEET FIREHOSE RESULT STREAM value fleetdm results stream prod ```

Kathy Satterlee · Answer

Are you using Orbit or vanilla osquery

pvirani · Answer

Vanilla

pvirani · Answer

This is how I m spinning osquery up on my hosts ``` usr bin env bash DUO changed due to curl sSL | apt key add curl sSL | apt key add OSQUERY apt key adv keyserver recv keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B apt key adv keyserver recv keys 33EE313BAD9589B7 add apt repository deb arch=amd64 deb main apt install osquery OSQUERY rm f etc osquery osquery secret rm f etc osquery osquery flags rm f etc osquery osquery flags default Fill osquery secret with stuff Note this is not actually sensitive and does not need to be any more secret echo enrollment secret gt etc osquery osquery secret Fill osquery flags default with stuff echo config plugin=tls enroll secret path= etc osquery osquery secret enroll tls endpoint= api v1 osquery enroll config tls endpoint= api v1 osquery config tls hostname= config refresh=300 config tls accelerated refresh=300 config tls max attempts=9999 distributed tls read endpoint= api v1 osquery distributed read distributed tls write endpoint= api v1 osquery distributed write carver start endpoint= api v1 osquery carve begin carver continue endpoint= api v1 osquery carve block gt etc osquery osquery flags default ln s etc osquery osquery flags default etc osquery osquery flags```

zwass · Answer

Looks like your osquery is configured to log to the local filesystem and not the Fleet server

pvirani · Answer

How do I specify it should log to the Fleet server This is the result of `sudo systemctl start osqueryd` so looks like I gotta specify it in the flagfile ```osqueryd service The osquery Daemon Loaded loaded usr lib systemd system osqueryd service disabled vendor preset enabled Active active running since Wed 2023 01 11 18 18 46 UTC 2h 29min ago Process 29213 ExecStartPre= bin sh c if f $LOCAL PIDFILE then mv $LOCAL PIDFILE $PIDFILE fi code=exited status=0 SUCCESS Process 29206 ExecStartPre= bin sh c if f $FLAG FILE then touch $FLAG FILE fi code=exited status=0 SUCCESS Main PID 29215 osqueryd Tasks 15 limit 4561 CGroup system slice osqueryd service 29215 opt osquery bin osqueryd flagfile etc osquery osquery flags config path etc osquery osquery conf 29646 opt osquery bin osqueryd Jan 11 19 38 54 ip 172 31 55 24 osqueryd 29215 W0111 19 38 54 303018 29680 options cpp 106 The CLI only flag logger plugin set via config file will be ignored please use a flagfile or pass it to the process at startup Jan 11 19 38 54 ip 172 31 55 24 osqueryd 29215 I0111 19 38 54 356914 29680 eventfactory cpp 352 The minimum events expiration timeout for hardware events has been adjusted 21660 Jan 11 19 38 54 ip 172 31 55 24 osqueryd 29215 I0111 19 38 54 356961 29680 config cpp 908 Calling configure for logger filesystem Jan 11 19 43 54 ip 172 31 55 24 osqueryd 29215 W0111 19 43 54 380683 29680 options cpp 106 The CLI only flag logger plugin set via config file will be ignored please use a flagfile or pass it to the process at startup Jan 11 19 43 54 ip 172 31 55 24 osqueryd 29215 I0111 19 43 54 455612 29680 eventfactory cpp 352 The minimum events expiration timeout for hardware events has been adjusted 21660 Jan 11 19 43 54 ip 172 31 55 24 osqueryd 29215 I0111 19 43 54 455659 29680 config cpp 908 Calling configure for logger filesystem Jan 11 19 46 37 ip 172 31 55 24 osqueryd 29215 I0111 19 46 37 928295 29684 query cpp 102 Storing initial results for new scheduled query pack osquery monitoring schedule Jan 11 20 17 12 ip 172 31 55 24 osqueryd 29215 I0111 20 17 12 569401 29684 query cpp 102 Storing initial results for new scheduled query pack hardware monitoring pci devices Jan 11 20 19 34 ip 172 31 55 24 osqueryd 29215 I0111 20 19 34 316332 29684 query cpp 102 Storing initial results for new scheduled query pack incident response open sockets Jan 11 20 27 22 ip 172 31 55 24 osqueryd 29215 I0111 20 27 22 376417 29684 query cpp 102 Storing initial results for new scheduled query pack it compliance usb devices```

Kathy Satterlee · Answer

``` logger plugin=tls logger tls endpoint= api v1 osquery log logger tls period=10```

Kathy Satterlee · Answer

It looks like you re missing those flags in osquery that will send logs to the Fleet server Once they hit Fleet the `FLEET OSQUERY RESULT LOG PLUGIN` comes in to play

pvirani · Answer

adding em back in

pvirani · Answer

the image will be ready in 22 mins I ll report back with the status then Thanks folks Definitely pinning <https osquery readthedocs io en stable installation cli flags > to my brower so I don t have to distrub y all with stupid questions again woman bowing skin tone 2

Kathy Satterlee · Answer

Always happy to help And you never know this might help someone else down the road as well Thanks for reaching out

Kathy Satterlee · Answer

Just let me know if that doesn t do the trick

pvirani · Answer

Oh for sure I ve benefitted so much from keyword search results yielding other people s posts smile

pvirani · Answer

it worked Thanks a bunch slightly smiling face

Kathy Satterlee · Answer

cloud rocket

clong · Answer

thanks for this thread it just help me out too slightly smiling face