Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pack scheduled query interval too low #20

Open
DasFaultier opened this issue Jun 7, 2023 · 0 comments
Open

pack scheduled query interval too low #20

DasFaultier opened this issue Jun 7, 2023 · 0 comments

Comments

@DasFaultier
Copy link

I tried to apply the config from osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml using fleetctl like so:

fleetctl config set --address https://fleetserver.example.com:443
fleetctl login --email ${FLEET_EMAIL} --password ${FLEET_PASSWORD}
fleetctl convert -f osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml -o osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
fleetctl apply -f osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
fleetctl logout

... and got the following error:

applying packs: POST /api/latest/fleet/spec/packs received status 400 Bad request: pack payload verification: pack scheduled query interval must be an integer greater than 1 and less than 604800

The reason for this error are several lines in the above mentioned file that say: interval: 0.

Changing the affected lines using something like
sed -i 's/interval: 0/interval: 28800/g' ./osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
solves the issue.

Both FleetDM server and fleetctl are version 4.32.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant