I’ve also restarted osqueryd, and tried to remove the DB before restarting, is there anything I can do to know which decorators it is considering or the cause of the issue? I may add that it is working for two other hosts and they are using the same configuration 🤔 It is only including the
spec: config: decorators: load: - SELECT uuid AS host_uuid FROM system_info - SELECT hardware_serial FROM system_info LIMIT 1 always: - >- SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time DESC LIMIT 1 interval: '3600': - SELECT hostname FROM system_info LIMIT 1 ...
in the scheduled query results (I guess it’s the default?) thanks!