From 7cb45305b2eae4377873cd3b3ad1094a0c8da2fe Mon Sep 17 00:00:00 2001 From: Zachary Wasserman Date: Tue, 12 Nov 2019 08:55:46 -0800 Subject: [PATCH] Update query scheduling FAQ (#2144) --- docs/infrastructure/faq.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/infrastructure/faq.md b/docs/infrastructure/faq.md index 2ccf815571..d815eed584 100644 --- a/docs/infrastructure/faq.md +++ b/docs/infrastructure/faq.md @@ -25,7 +25,8 @@ Expecting results, but not seeing anything in the logs? - Try scheduling a query that always returns results (eg. `SELECT * FROM time`). - Check whether the query is scheduled in differential mode. If so, new results will only be logged when the result set changes. - Ensure that the query is scheduled to run on the intended platforms, and that the tables queried are supported by those platforms. -- Look at the status logs provided by osquery. These are available on the filesystem of the Fleet server at the path configurable by [`--osquery_status_log_file`](./configuring-the-fleet-binary.md#osquery_status_log_file). This defaults to `/tmp/osquery_status`. +- Use live query to `SELECT * FROM osquery_schedule` to check whether the query has been scheduled on the host. +- Look at the status logs provided by osquery. In a standard configuration these are available on the filesystem of the Fleet server at the path configurable by [`--filesystem_status_log_file`](./configuring-the-fleet-binary.md#filesystem_status_log_file). This defaults to `/tmp/osquery_status`. The host will output a status log each time it executes the query. ## Why aren’t my live queries being logged?