Hello,
I am using Elastic Agent 8.19.14 and collecting systemd unit information through the Osquery Manager integration.
Recently, I have encountered an issue where, if I configure two query packs within the same Agent Policy, only one of the packs runs while the other does not.
The queries in both packs:
-
Are configured as Snapshot queries.
-
Have different query IDs.
-
Run at different intervals.
-
Are visible in the Inspect view.
-
Execute successfully when run manually as Live Queries.
However, when scheduled through the query packs, one pack consistently runs while the other does not. On the affected agent, I can see logs indicating that 0 events were sent to the index for the queries that do not execute.
Is this a known issue in Elastic Agent 8.19.14 or Osquery Manager? What could cause one scheduled Snapshot query pack to stop executing while another query pack in the same Agent Policy continues to work?
Any guidance on additional logs or diagnostics I should collect would be appreciated.