Outdated Osquery version - Latest 5.12.1

Elastic Stack Elasticsearch
,
1

Hello there,

hope you're all doing fine!

first of all the official elastic FAQ regarding Osquery says the following:
(Osquery FAQ | Kibana Guide [8.14] | Elastic)

How often is Osquery updated for Osquery Manager?edit

When a new version of Osquery is released, it is included in a subsequent Elastic Agent release and applied when the agent is upgraded. After that, when running queries from Osquery Manager in Kibana, the updated Osquery version is used. Refer to the Fleet and Elastic Agent Guide for help with upgrading Fleet-managed Elastic Agents.

To check what Osquery version is installed on an Elastic Agent, you can run SELECT version FROM osquery_info; as a live query in Kibana. The version in the response is the Osquery version installed on the agent.

My question simply is why the actual version we have (Cluster is 8.14.2) is 5.10.1 instead of 5.12.1?

Thanks for clarification!

2

Hi @daniel-san!

What version are your Elastic Agents on? Did you ever upgrade them?

3

@daniel-san The latest agent has osquery 5.10.2 distribution packaged with it.
We will update to 5.12.1 for the next agent release which at the moment I believe is going to be 8.16.

2 Likes
4

Hey, for sure we update them ;)! Some are at the newest version (8.14.3).

5

Thanks for your response! So i guess this is then somehow tied to upgrade the cluster to 8.16.x when its available?
Then we'll stay tuned. The thing is we're experiencing a pretty annoying bug in the Kibana Osquery UI interface that randomly shows Live Querys expiering due to no reason (the data is viewable in discover).
We had a ticket open due to this and they are working on a fix still to be released.
That the overall reason why i stumbled upon that version difference and wanted to be informed :wink:

6

Have you experienced memory leaks with scheduled packs running periodically?