# Osquery Live queries: windows endpoints not responding 'action undefined' **URL:** \ **Category:** Beats\ **Tags:** elastic-agent, osquery-manager\ **Created:** [February 2, 2022, 4:14pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087 "2022-02-02T16:14:57Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Post date:** [February 2, 2022, 4:14pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/1 "2022-02-02T16:14:57Z")
Hello, I installed Osquery manager integration on my endpoints, for linux it worked like magic, while on the windows I get the following results ![Screenshot from 2022-02-02 17-01-22](https://us1.discourse-cdn.com/elastic/original/3X/3/3/334f85c2e5868ac2594d71019fcfb64c3d2feb53.png) ![Screenshot from 2022-02-02 17-01-44](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38890b0c956fba26a022bdd8e1f7040028af4318.png) With no errors reported on log files (elastic-agent, osquerybeat, osquery ...). I note the following: - osqueryd is running. - queries are perfectly executed on the endpoint using osqueryi. - I keep getting Non-Zero Mertics messages on osquerybeat. Is there any required configuration to use osquery ? how does osquery manager read results from endpoint ? can you guide me to troubleshoot this problem ? Thank You ---
**Author:** ![Melissa\_Burpo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/melissa_burpo/32/144702_2.png) [@Melissa\_Burpo](https://discuss.elastic.co/u/Melissa_Burpo)\ **Post date:** [February 2, 2022, 5:55pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/2 "2022-02-02T17:55:50Z")
Hi @A_Abdellah. The `action undefined` message may mean that there's a problem with osquery running on that agent. Here's some info that will help to troubleshoot this: - What Kibana version is this in? - Did you recently upgrade Osquery Manager, or is it a newly added integration? - What's the status of this agent in Fleet? (You can check that in Kibana from Fleet \> Agents) > Is there any required configuration to use osquery ? No, there shouldn't be any additional setup beyond adding the integration to the agent policy. @aleksmaus may be able to better answer this question: "how does osquery manager read results from endpoint ?" ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [February 3, 2022, 2:02am UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/3 "2022-02-03T02:02:43Z")
@A_Abdellah The 'action undefined' error means that the agent is not running osquerybeat. Most likely you should be able to see in the agent logs that the agent can't find osquerybeat.exe file on the disk. The full chain of the processes involved in running osquerybeat is the following: the elastic agent starts osquerybeat, osquerybeat starts osqueryd, osqueryd starts osquery-extension. In some cases, on Windows, it looks like that osqueryd.exe process is still running after the agent is stopped and uninstalled, so the osquerybeat install directory is locked and could not be cleanly removed during uninstall. Then the next time the agent installs the osquerybeat, the osquerybeat install is skipped, because the directory is still there. We are currently looking into improving the agent child processes handling and uninstall/install/upgrade steps. Could you please confirm if the osquerybeat is missing from the osquerybeat install directory (osquerybeat install is corrupted)? The directory should have 3 binaries: osquerybeat, osqueryd, and osquery-extension. The workaround for this problem at the moment would be to stop the agent, remove the corrupted osquerybeat install directory manually, then start the agent again. The agent should install osquerybeat if osquery\_manager is enabled for the agent policy. You should be able to see the install logged in the agent log. Another thing to try is to uninstall the agent, checked that all directories are removed and reinstall it. If you you can capture any errors in the logs, please let us know. Let us know if this works for you. ---
**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Post date:** [February 3, 2022, 8:44am UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/4 "2022-02-03T08:44:39Z")
I'm using version 7.16.2 Kibana and Elastic agent, and osquery manager is at version 0.8.0 ---
**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Post date:** [February 3, 2022, 1:31pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/5 "2022-02-03T13:31:15Z")
Hello @aleksmaus, I stopped the agent and cleanly removed osquerybeat install folder then waited osquerybeat to be reinstalled, I can see osquerybeat runing on my endpoint from task manager and I still get 'action undefined' for my queries. ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [February 3, 2022, 3:30pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/6 "2022-02-03T15:30:12Z")
@A_Abdellah I just tested with 7.16.3 stack and the agent on Windows 10 Pro and everything worked out of the box. What version of the stack you are running and on what platform? Could you check couple of more things: 1. Is osquerybeat a child process of elastic-agent (not orphan)? Should look something like this in sysinternals "Process Explorer" for example: 2. Double check that you send that query to agent where the osquery was enabled The agent id on Kibana UI ![Screen Shot 2022-02-03 at 10.13.00 AM](https://us1.discourse-cdn.com/elastic/original/3X/5/4/548654e8c047c92e25586c6d10ddbf9de9a0f787.png) ![Screen Shot 2022-02-03 at 10.17.18 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a4f7dfa6d2daf2d1e059bdc1a3f5edb3dcdb03ca.png) should match the agent id in the fleet.yml file on the agent ![Screen Shot 2022-02-03 at 10.13.14 AM](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0dc6e3d1b125856d37fe5877b45a950740cf8667.png) You can enable debug log for the agent at the bottom of the agent details page (log tab) ![Screen Shot 2022-02-03 at 10.25.40 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5f6a5a2a73d4e711fa43dcbe81e4041d49e840a.png) There should be debug level logs in the agent log when the agent receives the osquery action and dispatches it to the osquerybeat ![Screen Shot 2022-02-03 at 10.22.31 AM](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b81b0610efe25fb5bb17a6a2c35273015339fcd.png) and osquerybeat log should show the query being executed and results sent back ![Screen Shot 2022-02-03 at 10.23.40 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1820e1a8f5ecee2b18d79a8311ab28d282f2895.png) Could please verify everything above and provide some additional information where it doesn't work as expected? Thank you for the help debugging this issue. ---
**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Post date:** [February 6, 2022, 8:26pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/7 "2022-02-06T20:26:59Z")
@aleksmaus I'm running the version 7.16.2 of the stack on linux. I saw that osquerybeat.exe is orphan. I think this is my lead now. how can I fix that?? ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [February 7, 2022, 2:40pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/8 "2022-02-07T14:40:39Z")
It's unclear how it became orphan at this point, there are two possibilities: 1. The agent process crashed for some reason. 2. The agent process was killed by the system. You can kill the osquerybeat processes tree (and any other orphaned beats processes if they are running) and restart the agent. The agent should re- create all the beats processes as child processes. Use process explorer to see what is happening with the agent process tree during restart. Maybe try to capture the agent logs if this happens again. Check the system logs to see if there is anything pointing to the agent service process. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2022, 4:41pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087/9 "2022-03-07T16:41:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.