Open
Description
Bug report
What operating system and version are you using?
Primarily CentOS 7.9.2009, and then (descending order), CentOSStream 8, RedHatEnterpriseServer 7.9, RedHatEnterprise 8.4, CentOS 7.8.2003.
What version of osquery are you using?
Primarily 5.8.1 right now, but a tail that includes 5.7.0 all the way back to 5.1.0
What steps did you take to reproduce the issue?
On any of our hosts, for the last couple years, when we check osquery_schedule table, the only fields filled out are name, query, and interval. Everything else is the default 0s. We have a scheduled query:
select
name,
interval,
executions,
output_size,
wall_time,
(user_time / executions) as avg_user_time,
(system_time / executions) as avg_system_time,
average_memory,
last_executed,
denylisted
from
osquery_schedule
... and it's always reported only 0s in our setup. I can use osqueryi and connect to our osqueryd socket too, and it shows the same.
What did you expect to see?
As described by the schema, I'd expect to see executions, last_execution, and many of the other fields update.
What did you see instead?
Zeroes (default) for most of the statistics. Interval was filled out, though.