diff --git a/changes/5992-fix-no-such-table-errors-mdm-munki b/changes/5992-fix-no-such-table-errors-mdm-munki new file mode 100644 index 0000000000..e05cde1129 --- /dev/null +++ b/changes/5992-fix-no-such-table-errors-mdm-munki @@ -0,0 +1 @@ +* Fixed `no such table` errors for `mdm` and `munki_info` for vanilla osquery macOS hosts. diff --git a/server/service/osquery_test.go b/server/service/osquery_test.go index f3926f8351..f2dcb42d1b 100644 --- a/server/service/osquery_test.go +++ b/server/service/osquery_test.go @@ -413,6 +413,8 @@ func verifyDiscovery(t *testing.T, queries, discovery map[string]string) { discoveryUsed := map[string]struct{}{ hostDetailQueryPrefix + "google_chrome_profiles": {}, hostDetailQueryPrefix + "orbit_info": {}, + hostDetailQueryPrefix + "mdm": {}, + hostDetailQueryPrefix + "munki_info": {}, } for name := range queries { require.NotEmpty(t, discovery[name]) diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index 3e2268065f..d6093c1716 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -48,10 +48,12 @@ func (q *DetailQuery) RunsForPlatform(platform string) bool { return false } -// detailQueries defines the detail queries that should be run on the host, as +// hostDetailQueries defines the detail queries that should be run on the host, as // well as how the results of those queries should be ingested into the -// fleet.Host data model. This map should not be modified at runtime. -var detailQueries = map[string]DetailQuery{ +// fleet.Host data model (via IngestFunc). +// +// This map should not be modified at runtime. +var hostDetailQueries = map[string]DetailQuery{ "network_interface": { Query: `select ia.address, id.mac, id.interface from interface_details id join interface_addresses ia @@ -306,15 +308,25 @@ FROM logical_drives WHERE file_system = 'NTFS' LIMIT 1;`, Platforms: []string{"windows"}, IngestFunc: ingestDiskSpace, }, +} + +// extraDetailQueries defines extra detail queries that should be run on the host, as +// well as how the results of those queries should be ingested into the hosts related tables +// (via DirectIngestFunc). +// +// This map should not be modified at runtime. +var extraDetailQueries = map[string]DetailQuery{ "mdm": { Query: `select enrolled, server_url, installed_from_dep from mdm;`, DirectIngestFunc: directIngestMDM, Platforms: []string{"darwin"}, + Discovery: discoveryTable("mdm"), }, "munki_info": { Query: `select version from munki_info;`, DirectIngestFunc: directIngestMunkiInfo, Platforms: []string{"darwin"}, + Discovery: discoveryTable("munki_info"), }, "google_chrome_profiles": { Query: `SELECT email FROM google_chrome_profiles WHERE NOT ephemeral AND email <> ''`, @@ -851,7 +863,10 @@ func directIngestMunkiInfo(ctx context.Context, logger log.Logger, host *fleet.H func GetDetailQueries(ac *fleet.AppConfig, fleetConfig config.FleetConfig) map[string]DetailQuery { generatedMap := make(map[string]DetailQuery) - for key, query := range detailQueries { + for key, query := range hostDetailQueries { + generatedMap[key] = query + } + for key, query := range extraDetailQueries { generatedMap[key] = query }