https://github.com/osquery/osquery logo
#fleet
Title
# fleet
s

Stephan

11/29/2021, 4:36 AM
For some reason fleet does not seem to pick up on when queries have run. The logs show that it's executing a scheduled query pack but when I check the fleet UI it shows up as
Has not run
Fleet 4.6.1 Osquery 4.0.1
Copy code
I1128 20:27:36.493018 16757 scheduler.cpp:105] Executing scheduled query pack/system/cron-4171cea29024861e32427af268f8219ba91a5a85/crontab-4171cea29024861e32427af268f8219ba91a5a85
t

Tomas Touceda

11/29/2021, 1:11 PM
hi there, that's interesting, does it happen with any queries for that host? Could you check fleet serve with --logging_debug and see if it logs anything useful?
s

Stephan

11/29/2021, 3:12 PM
This is our staging environment so it's only one host enrolled 🙂. Wanted to make sure all is well before pushing to prod as that'll hit 10s of thousands of instances. I'll try logging debug and report back, thank you
2 Views