Just noticed that the `osquery packs` table doesn t seem to

Question

Just noticed that the `osquery packs` table doesn t seem to be registering my shard settings correctly I m guessing this is a bug Happy to file it ``` STD DEV 16 48 00 root si i 02caa65087583c219 home zmackie cat usr share osquery packs testing conf testing shard 10 lt lt lt queries osquery info query SELECT FROM osquery info interval 86400 description Information about the running osquery configuration snapshot true This is a simple example query that outputs basic system information system info The exact query to run query SELECT hostname cpu brand physical memory FROM system info The interval in seconds to run this query not an exact interval interval 3600 crontab query select from crontab interval 3600 platform posix version 1 4 5 description Retrieves all the jobs scheduled in crontab in the target system value Identify malware that uses this persistence mechanism to launch at a given interval STD DEV 16 48 23 root si i 02caa65087583c219 home zmackie echo select from osquery packs | osqueryi + + + + + + + + | name | platform | version | shard | discovery cache hits | discovery executions | active | + + + + + + + + | main | | | 0 | 1 | 1 | 1 | | base | posix | | 0 | 1 | 1 | 1 | | testing | | | 0 lt lt lt | 1 | 1 | 1 | | osquery monitoring | | | 0 | 1 | 1 | 1 | + + + + + + + +```

seph · Answer

docs have it in quotes Did you try that

Zander Mackie · Answer

Its not in quotes in other places but I ll give that a shot

Zander Mackie · Answer

That pack is also not active now that I look at the results log

Zander Mackie · Answer

Quotes don t seem to help

sharvil · Answer

Can you pass in the ` verbose` flag too See if anything pop up And which version of osquery is it

Zander Mackie · Answer

```^ A STD DEV 17 38 24 root si i 02caa65087583c219 home zmackie echo select from osquery packs | osqueryi verbose I0910 17 38 27 343184 14644 init cpp 357 osquery initialized version=4 9 0 I0910 17 38 27 343250 14644 extensions cpp 453 Could not autoload extensions Cannot open file for reading etc osquery extensions load I0910 17 38 27 343308 14644 init cpp 568 An error occurred during extension manager startup Extensions disabled I0910 17 38 27 343335 14644 auto constructed tables cpp 97 Removing stale ATC entries I0910 17 38 27 343868 14644 packs cpp 177 No queries defined for pack testing I0910 17 38 27 345997 14644 virtual table cpp 1081 Table curl is disabled not attaching I0910 17 38 27 358563 14644 smbios tables cpp 105 Reading SMBIOS from sysfs DMI node I0910 17 38 27 358790 14644 eventfactory cpp 156 Event publisher not enabled BPFEventPublisher Publisher disabled via configuration I0910 17 38 27 358808 14644 eventfactory cpp 156 Event publisher not enabled auditeventpublisher Publisher disabled via configuration I0910 17 38 27 358827 14644 eventfactory cpp 156 Event publisher not enabled syslog Publisher disabled via configuration I0910 17 38 27 358891 14644 events cpp 36 Skipping subscriber apparmor events Subscriber disabled via configuration I0910 17 38 27 358942 14644 events cpp 36 Skipping subscriber process file events Subscriber disabled via configuration I0910 17 38 27 358955 14644 events cpp 36 Skipping subscriber seccomp events Seccomp subscriber disabled via configuration I0910 17 38 27 358966 14644 events cpp 36 Skipping subscriber selinux events Subscriber disabled via configuration I0910 17 38 27 358978 14644 events cpp 36 Skipping subscriber socket events Subscriber disabled via configuration I0910 17 38 27 359735 14644 file events cpp 87 Added file event listener to etc logrotate d I0910 17 38 27 359752 14644 file events cpp 87 Added file event listener to etc systemd I0910 17 38 27 359760 14644 file events cpp 87 Added file event listener to etc rc I0910 17 38 27 359768 14644 file events cpp 87 Added file event listener to etc passwd I0910 17 38 27 359776 14644 file events cpp 87 Added file event listener to etc ssh sshd config I0910 17 38 27 359784 14644 file events cpp 87 Added file event listener to etc ssh ssh config I0910 17 38 27 359795 14644 file events cpp 87 Added file event listener to etc pam I0910 17 38 27 359805 14644 file events cpp 87 Added file event listener to etc pam d I0910 17 38 27 369658 14722 eventfactory cpp 390 Starting event publisher run loop inotify I0910 17 38 27 369678 14723 eventfactory cpp 390 Starting event publisher run loop udev + + + + + + + + | name | platform | version | shard | discovery cache hits | discovery executions | active | + + + + + + + + | main | | | 0 | 1 | 1 | 1 | | base | posix | | 0 | 1 | 1 | 1 | | testing | | | 0 | 1 | 1 | 1 | | osquery monitoring | | | 0 | 1 | 1 | 1 | + + + + + + + + I0910 17 38 27 369870 14644 dispatcher cpp 149 Thread 140224691451584 requesting a stop I0910 17 38 27 369884 14644 dispatcher cpp 122 Thread 140224691451584 requesting a join I0910 17 38 27 369895 14644 dispatcher cpp 144 Services and threads have been cleared```

Zander Mackie · Answer

Version is `4 9 0`

sharvil · Answer

hrm `No queries defined for pack testing` in the verbose output

Zander Mackie · Answer

oh

Zander Mackie · Answer

huh wonder if its malformed somehow

sharvil · Answer

i think so too

sharvil · Answer

shouldn t `system info` and `crontab` be inside the `queries` block