https://github.com/osquery/osquery logo
#general
Title
# general
a

Ahmed

12/24/2019, 10:10 AM
Hey Folks, How can we determine which config is bing used by osqury agents. When i run a query about the configs i get the same hash so thats good but i want to know which config is being used. When i try to calc the hash i dont get same results
z

zwass

12/24/2019, 3:34 PM
You might try
select * from osquery_schedule
to see which queries are scheduled.
a

Ahmed

12/24/2019, 3:41 PM
Sorry if my question was not clear. I mean when we run
select config_hash from osquery_info;
i wanted to know what is the config that it should represent this hash
z

zwass

12/24/2019, 3:59 PM
If you are using the config from Fleet then the config is generated dynamically for each host based on which labels that host is in and what query packs are targeting that label. There's not a straightforward way to calculate the hash.
4 Views