https://github.com/osquery/osquery logo
#fleet
Title
# fleet
n

n0b00de

03/29/2022, 5:44 PM
Is there a process to backup the queries i’ve added to my fleet?
k

Kathy Satterlee

03/29/2022, 6:20 PM
Definitely! It's actually fairly straightforward using `fleetctl`:
Copy code
fleetctl get queries --yaml > query_backup_3_29_22.yml
^ Would retrieve all queries in YAML format and save it so that you could easily apply the file down the road to restore them.
💰 1
n

n0b00de

03/29/2022, 6:43 PM
Is this documented anywhere?
k

Kathy Satterlee

03/29/2022, 6:48 PM
Not in detail, but I've already added it to my list of doc updates for this week. There's lots of updates to the documentation for
fleetctl
coming down the pipe!
n

n0b00de

03/30/2022, 3:24 PM
Dope. Now would I use this command to upload the queries I’ve backup
Copy code
fleetctl apply -f query_backup.yml
1
k

Kathy Satterlee

03/30/2022, 3:37 PM
Exactly.
💯 1
n

n0b00de

04/01/2022, 6:53 PM
@Kathy Satterlee I’m getting the following when i perform the backup command
Copy code
Login failed: POST /api/v1/fleet/login: do request: Post "https://<IP_ADDRESS>:8080/api/v1/fleet/login": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0
@User When I performed the backup command i the yaml file just said
Copy code
please login with: fleetctl login
When I do I get the following
Copy code
Login failed: POST /api/v1/fleet/login: do request: Post "https://<IP_ADDRESS>:8080/api/v1/fleet/login": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0
Seen this before??
5 Views