Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 08:58:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 111

Log denylisted queries as errors (#8294)

Browse source
This commit is contained in:
Lucas Manuel Rodriguez 2022-10-27 13:17:14 -03:00 committed by GitHub
parent 7d855c3879
commit 1fa5475e6e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
server/service/osquery.go
View file

@ -807,7 +807,13 @@ func (svc *Service) SubmitDistributedQueryResults(
status, ok := statuses[query]
failed := ok && status != fleet.StatusOK
if failed && messages[query] != "" && !noSuchTableRegexp.MatchString(messages[query]) {
level.Debug(svc.logger).Log("query", query, "message", messages[query])
ll := level.Debug(svc.logger)
// We'd like to log these as error for troubleshooting and improving of distributed queries.
if messages[query] == "distributed query is denylisted" {
ll = level.Error(svc.logger)
}
ll.Log("query", query, "message", messages[query], "hostID", host.ID)
}
var err error
switch {