https://github.com/osquery/osquery logo
#fleet
Title
# fleet
r

Ryan

11/24/2021, 2:47 PM
Hi, quick question - we’re rebuilding our Fleet from scratch and migrating hosts over, is there a quick way to export/import the existing queries and query packs?
I thought the tables
queries
,
packs
and
pack_targets
would be sufficient, but the
queries
table seems to contain way more than the UI showed (possibly a history of queries too)?
t

Tomas Touceda

11/24/2021, 2:55 PM
hi! we don't currently have a standard way to do this, but one way would be to use
fleetctl get packs --with-queries
and then apply that in the new install
r

Ryan

11/24/2021, 2:57 PM
ah nice idea
thanks!
👍 1
Hmm, the
--with-queries
option doesn’t appear to have any affect
It returns the
name
platform
description
and
disabled
columns in both cases
t

Tomas Touceda

11/24/2021, 3:01 PM
what version of fleetctl are you running?
oh, also, try adding
--yaml
r

Ryan

11/24/2021, 3:01 PM
Copy code
fleetctl - version 4.6.1
  branch:       HEAD
  revision:     2b2e9f9f44d55c06ce8ce1249b0f2166f2ebb3a0
  build date:   2021-11-22
  build user:   runner
  go version:   go1.17.2
👍 1
Ok, will try that
aha yes
that did it
😄
It did look like it was gathering the extra data, because the command took longer to execute when
--with-queries
was present.
t

Tomas Touceda

11/24/2021, 3:03 PM
yeah, the UX is not ideal, it should've warned you that you probably wanted to add
--yaml
or
--json
r

Ryan

11/24/2021, 3:04 PM
No worries 🙂
Ok, all good, queries and packs “transplanted” from one brain to the other.
Thanks again!
t

Tomas Touceda

11/24/2021, 3:08 PM
great to hear!
r

Ryan

11/24/2021, 3:17 PM
One oddity of doing this, as hosts are coming back online, we’ve got this weird situation on the “Hosts” tab:
If I invert the sort order I can see normal hostnames in alphabetical order, when we get to the beyond the letter A it’s all blank hostnames “offline”. I assume that will sort itself out though later?
we have Host Expiry Window of 1 day, so should be ok I think, but just wanted to let you know
t

Tomas Touceda

11/24/2021, 4:06 PM
thanks, that is extremely weird, let me know if it sorts itself out otherwise we'll dig deeper
r

Ryan

11/24/2021, 4:06 PM
👍
FYI @Tomas Touceda it did indeed sort itself out, we’re all good again 🙂
t

Tomas Touceda

11/29/2021, 11:46 AM
great!
3 Views