@sean.cavanaugh i probably will not be able to provide much help as this is in regards to the since-deprecated kolide fleet project, but out of curiosity are you running osqueryi with sudo?
s
sean.cavanaugh
11/15/2021, 5:06 PM
will move to the other channel, but no I’m not running osqueryi w/ root
f
fritz
11/15/2021, 5:23 PM
results will differ based on whether osquery is run as root/sudo, since fleet by default runs queries as root, you will need to run osqueryi with sudo to appropriately compare the output of the two.