Skip to content

osquery_schedule not updating most statistics #8007

Open
@harlan-B

Description

Bug report

What operating system and version are you using?

Primarily CentOS 7.9.2009, and then (descending order), CentOSStream 8, RedHatEnterpriseServer 7.9, RedHatEnterprise 8.4, CentOS 7.8.2003.

What version of osquery are you using?

Primarily 5.8.1 right now, but a tail that includes 5.7.0 all the way back to 5.1.0

What steps did you take to reproduce the issue?

On any of our hosts, for the last couple years, when we check osquery_schedule table, the only fields filled out are name, query, and interval. Everything else is the default 0s. We have a scheduled query:

select 
  name, 
  interval, 
  executions, 
  output_size, 
  wall_time, 
  (user_time / executions) as avg_user_time, 
  (system_time / executions) as avg_system_time, 
  average_memory, 
  last_executed, 
  denylisted 
from 
  osquery_schedule

... and it's always reported only 0s in our setup. I can use osqueryi and connect to our osqueryd socket too, and it shows the same.

What did you expect to see?

As described by the schema, I'd expect to see executions, last_execution, and many of the other fields update.

What did you see instead?

Zeroes (default) for most of the statistics. Interval was filled out, though.

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions