https://github.com/osquery/osquery logo
#sql
Title
# sql
s

seph

05/31/2022, 2:07 PM
I would expect that to work, it does on my machine. Where are you seeing those numbers? could your data pipeline be adding them? Is this osqueryi?
a

Andreas Piening

06/08/2022, 8:24 PM
Sorry for the late response: I didn’t receive a notification because your answer was not in the thread of my post. I get these numbers (like
29.370000000000001
for
free_perc
) in the
fleet
web interface as well as on the console using
fleetctl
.
s

seph

06/08/2022, 8:26 PM
Can you reproduce this in osqieryi?
a

Andreas Piening

06/08/2022, 8:31 PM
Hmm… I’m running
orbit
and it seems there is no
osqueryi
binary available on my systems.
s

seph

06/08/2022, 8:32 PM
I’m not super familiar with the fleet ecosystem.
If you know the path to
osqueryd
you can run
osqueryd -S
a

Andreas Piening

06/08/2022, 8:33 PM
Oh great, that works!
The results are fine there. Only 1-2 digits.
So it looks like fleet is messing up the results? That’s strange.
s

seph

06/08/2022, 8:34 PM
If you get reasonable numbers from osqueryi, then I suspect this is something fishy in how fleet is doing number conversion, and I’d bounce you to #fleet to debug. It’s possible it’s specific to the osquery schedule, you’d need to see raw logs to be sure. But I suspect this is in fleet, somewhere.
It all smells like floating point errors
a

Andreas Piening

06/08/2022, 8:36 PM
Yes, this makes sense. I’ll start a post in #fleet. Thank you very much!
4 Views