fleet/15168-scheduled-outside-fleet at 608038a1bb1879ae37960a25a5fe9ad48de0d86e - fleet - example

empayre/fleet

mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00

Lucas Manuel Rodriguez ab0700b4e0

Fix osquery result logging when queries are configured outside of Fleet (#15393 )

#15168

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [X] Added/updated tests.
- [X] Manual QA for all new/changed functionality.

The issue can be reproduced by running `osqueryd` with
`--config_plugin=filesystem --config_path=/path/to/config.json`
This means the osquery config is fetched from a file rather than from
Fleet's agent settings.
The `/path/to/config.json` has the agent settings, e.g.:
```
{
  "decorators": {
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;",
      "SELECT hostname AS hostname FROM system_info;"
    ]
  },
  "options": {
    "disable_distributed": false,
    "distributed_interval": 10,
    "distributed_plugin": "tls",
    "distributed_tls_max_attempts": 3,
    "logger_tls_endpoint": "/api/osquery/log",
    "logger_tls_period": 10,
    "pack_delimiter": "/"
  },
  "schedule": {
    "USB devices": {
      "query": "SELECT * FROM usb_devices;",
      "interval": 15
    },
    "OS version": {
      "query": "SELECT * FROM os_version;",
      "interval": 10
    }
  },
  "packs": {
    "Elsewhere": {
      "queries": {
        "Osquery Info": {
          "query": "SELECT * FROM osquery_info;",
          "interval": 30,
          "platform": "",
          "version": "",
          "snapshot": true
        }
      }
    }
  }
}
```

The three queries should be logged to Fleet's configured result logging
destination (default is `filesystem`).

2023-12-04 11:18:49 -03:00

2 lines

142 B

Plaintext

Raw Blame History

* Fixed logging of results for scheduled queries configured outside of Fleet, when `server_settings.query_reports_disabled` is set to `true`.