# \#osquery-manager **URL:** https://discuss.elastic.co/tag/osquery-manager/94.md [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) --- ## [Osquery Manager Feedback](https://discuss.elastic.co/t/osquery-manager-feedback/376784)
**Author:** [@daniel-san](https://discuss.elastic.co/u/daniel-san)\ **Replies:** 0\ **Last updated:** [April 4, 2025, 11:05am UTC](https://discuss.elastic.co/t/osquery-manager-feedback/376784 "2025-04-04T11:05:15Z")
The Live query dont show its results straight away. When we review the ingested data in Discover, everything is fine. But the "preview" section in live query UI is always timing out (pending). The agent responded and the… --- ## [OsQuery high consumption memory](https://discuss.elastic.co/t/osquery-high-consumption-memory/370090)
**Author:** [@Gaston\_Beltramelli](https://discuss.elastic.co/u/Gaston_Beltramelli)\ **Replies:** 3\ **Last updated:** [December 27, 2024, 3:02pm UTC](https://discuss.elastic.co/t/osquery-high-consumption-memory/370090 "2024-12-27T15:02:24Z")
We are trying in production for the first time and in many server, we deployed it in 40 servers and we saw that OsQuery use up to 1.4gb of memory. I couldn´t find any information or workarround or even if it is normal co… --- ## [Outdated Osquery version - Latest 5.12.1](https://discuss.elastic.co/t/outdated-osquery-version-latest-5-12-1/363852)
**Author:** [@daniel-san](https://discuss.elastic.co/u/daniel-san)\ **Replies:** 5\ **Last updated:** [November 9, 2024, 6:03pm UTC](https://discuss.elastic.co/t/outdated-osquery-version-latest-5-12-1/363852 "2024-11-09T18:03:20Z")
Hello there, hope you're all doing fine! first of all the official elastic FAQ regarding Osquery says the following: (Osquery FAQ | Kibana Guide \[8.14\] | Elastic) How often is Osquery updated for Osquery Manager?edi… --- ## [Schedule times](https://discuss.elastic.co/t/schedule-times/366487)
**Author:** [@UweW](https://discuss.elastic.co/u/UweW)\ **Replies:** 1\ **Last updated:** [September 19, 2024, 5:44pm UTC](https://discuss.elastic.co/t/schedule-times/366487 "2024-09-19T17:44:23Z")
Hi, how can i influence when the scheduled packs are executed? At the moment I can't see when they are executed. For example, if I want to collect information from the windows clients once a day, this has to happen dur… --- ## [Fleet Deploy OSQuery to Windows](https://discuss.elastic.co/t/fleet-deploy-osquery-to-windows/356301)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 3\ **Last updated:** [April 17, 2024, 1:24pm UTC](https://discuss.elastic.co/t/fleet-deploy-osquery-to-windows/356301 "2024-04-17T13:24:35Z")
I have successfully deployed both OSQuery manager and one agent to a Linux machine. However; my deployment to a Windows box doesn't seem to be working. I believe it's because the log path needs to be modified to someth… --- ## [Support for Osquery's Carves Table in Upcoming Roadmap?](https://discuss.elastic.co/t/support-for-osquerys-carves-table-in-upcoming-roadmap/342874)
**Author:** [@Bearloggs](https://discuss.elastic.co/u/Bearloggs)\ **Replies:** 0\ **Last updated:** [September 12, 2023, 4:59pm UTC](https://discuss.elastic.co/t/support-for-osquerys-carves-table-in-upcoming-roadmap/342874 "2023-09-12T16:59:09Z")
Hello, I've been exploring the integration of osquery with Elastic and was curious about a specific feature – the support for osquery's "carves table". The ability to use the carves table for file pulling can be incred… --- ## [Osquery has results but not displaying them](https://discuss.elastic.co/t/osquery-has-results-but-not-displaying-them/334606)
**Author:** [@meni0n](https://discuss.elastic.co/u/meni0n)\ **Replies:** 2\ **Last updated:** [June 19, 2023, 1:01pm UTC](https://discuss.elastic.co/t/osquery-has-results-but-not-displaying-them/334606 "2023-06-19T13:01:01Z")
I have osquery agent returning results but the result page keeping saying "1 agent has responded, no osquery data has been reported." --- ## ["Unable to completely restore the URL" when viewing results from osquery in discover](https://discuss.elastic.co/t/unable-to-completely-restore-the-url-when-viewing-results-from-osquery-in-discover/327231)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [March 9, 2023, 3:07pm UTC](https://discuss.elastic.co/t/unable-to-completely-restore-the-url-when-viewing-results-from-osquery-in-discover/327231 "2023-03-09T15:07:37Z")
Hey, When investigating the results from osquery, I want to use the "View in Discover" button: It leads me to discover, but applies no filters and shows an error popup with the message "Unable to completely restore … --- ## [Osquery in new space not working](https://discuss.elastic.co/t/osquery-in-new-space-not-working/319869)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 12:22am UTC](https://discuss.elastic.co/t/osquery-in-new-space-not-working/319869 "2022-12-02T00:22:03Z")
Why does this keep happening? Osquery packs only work from the Default space, any other space where I created a new pack, this happens: --- ## [Osquery View in Discover issue](https://discuss.elastic.co/t/osquery-view-in-discover-issue/315367)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 7:38pm UTC](https://discuss.elastic.co/t/osquery-view-in-discover-issue/315367 "2022-10-11T19:38:56Z")
We are running Elastic-Stack 8.4.2 (All components, inclusive the agents) and started to use Osquery. It is a great technology, however there are some problems we've encountered: Displaying the Data in Discover with the… --- ## [Osquery Manager Feedback - OSQuery manager API needed for automatically downloading Elastic packs](https://discuss.elastic.co/t/osquery-manager-feedback-osquery-manager-api-needed-for-automatically-downloading-elastic-packs/314536)
**Author:** [@joedissmeyer](https://discuss.elastic.co/u/joedissmeyer)\ **Replies:** 2\ **Last updated:** [September 16, 2022, 7:36pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-osquery-manager-api-needed-for-automatically-downloading-elastic-packs/314536 "2022-09-16T19:36:51Z")
Hello! Is there a Kibana API I can use to automatically download and install the Elastic created OSquery manager packs? There are several APIs available documented here, Osquery manager API | Kibana Guide \[8.4\] | Elasti… --- ## [Need osquery table name which keeps track of successful and failed root user logging information](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 2\ **Last updated:** [June 21, 2022, 8:43am UTC](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174 "2022-06-21T08:43:08Z")
Hi Experts, Can someone please assist me with the osquery table name which keeps track of successful and failed root user logging information? Note: I already checked users, logged\_in\_users, but no luck. Thanks, Nive… --- ## [Osquery Manager does not return results from curl table](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019)
**Author:** [@hwang](https://discuss.elastic.co/u/hwang)\ **Replies:** 7\ **Last updated:** [May 19, 2022, 5:28pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019 "2022-05-19T17:28:33Z")
Hi Elastic team, Running a query from the curl table returns an empty result. I've confirmed that other queries work and curl\_certificates work as well. SELECT \* FROM curl WHERE url = 'https://www.google.com' Is there… --- ## [Use Yara custom rules with Osquery-Manager](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 6\ **Last updated:** [May 9, 2022, 11:23am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789 "2022-05-09T11:23:00Z")
Hello Team, Is It possible to use yara custom rules with osquery manager integration ?? I'm using version 7.17.1 Many thanks. --- ## [No Result from osquery elastic agent 7.14.0](https://discuss.elastic.co/t/no-result-from-osquery-elastic-agent-7-14-0/281097)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 12\ **Last updated:** [March 31, 2022, 5:26pm UTC](https://discuss.elastic.co/t/no-result-from-osquery-elastic-agent-7-14-0/281097 "2022-03-31T17:26:36Z")
I have tried to run the query using osquery manager on one of my agent select \* from users However, no result is returned. I got the below message from my agent logs {"log.level":"warn","@timestamp":"2021-08-11T08:27… --- ## [Error Querying Windows System using Osquery Manager on Kibana](https://discuss.elastic.co/t/error-querying-windows-system-using-osquery-manager-on-kibana/296354)
**Author:** [@mibeyki](https://discuss.elastic.co/u/mibeyki)\ **Replies:** 13\ **Last updated:** [February 15, 2022, 5:01pm UTC](https://discuss.elastic.co/t/error-querying-windows-system-using-osquery-manager-on-kibana/296354 "2022-02-15T17:01:17Z")
Hello there, I have successfully setup and ELK stack v7.17.0 fully integrated with Fleet and Osquery manager. When I try to query the remote windows agent using osquery live queries, i get the error below; TypeError: … --- ## [Osquery Live queries: windows endpoints not responding 'action undefined'](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 7\ **Last updated:** [February 7, 2022, 2:40pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087 "2022-02-07T14:40:39Z")
Hello, I installed Osquery manager integration on my endpoints, for linux it worked like magic, while on the windows I get the following results With no errors reported on log files (elastic-agent, osquerybeat, o… --- ## [OSQuery Manager Pack scheduled queries not executed on ELK 7.16.2 and 7.16.3?](https://discuss.elastic.co/t/osquery-manager-pack-scheduled-queries-not-executed-on-elk-7-16-2-and-7-16-3/295028)
**Author:** [@BSL](https://discuss.elastic.co/u/BSL)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 3:41pm UTC](https://discuss.elastic.co/t/osquery-manager-pack-scheduled-queries-not-executed-on-elk-7-16-2-and-7-16-3/295028 "2022-01-24T15:41:33Z")
Scheduled OSQuery Manager Pack queries don't seem to work on fresh installs of ELK 7.16.2 and 7.16.3 (tried 2 completely separate ELK installations, one hosted on Ubuntu 20.04 with TLS+cert, one on Windows 11 unsecure, b… --- ## [Osquery exported fields](https://discuss.elastic.co/t/osquery-exported-fields/293608)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:07am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608 "2022-01-06T04:07:12Z")
I'm running 7.16.1 for everything. including elastic-agent-7.16.1-linux-x86\_64.tar.gz I have a question on osquery exported fields. From this URL: Osquery Manager | Elastic Docs It states that fields like interface\_… --- ## [Osquery results don't come in: "matching app is not found for action input: osquery"](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [December 20, 2021, 11:14pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381 "2021-12-20T23:14:45Z")
Hey, unfortunately, I managed to break my OSQuery integrations again. A simple query like SELECT \* FROM os\_version; yields the error message matching app is not found for action input: osquery for most of my hosts. Ed… --- ## [Osquery Manager Feedback](https://discuss.elastic.co/t/osquery-manager-feedback/290825)
**Author:** [@Aitor](https://discuss.elastic.co/u/Aitor)\ **Replies:** 2\ **Last updated:** [December 3, 2021, 6:09pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback/290825 "2021-12-03T18:09:13Z")
Hi there, I have installed osquery manager and I am not able to do live queries from the fleet elastic cloud instance (v 7.15.2). I always get the message: "2 agents have responded, no osquery data has been reported" wh… --- ## [Fleet Call to action - osquerybeat-7.15.0-linux-arm64.tar.gz' returned unsuccessful status code: 404](https://discuss.elastic.co/t/fleet-call-to-action-osquerybeat-7-15-0-linux-arm64-tar-gz-returned-unsuccessful-status-code-404/285065)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 6\ **Last updated:** [October 14, 2021, 10:27pm UTC](https://discuss.elastic.co/t/fleet-call-to-action-osquerybeat-7-15-0-linux-arm64-tar-gz-returned-unsuccessful-status-code-404/285065 "2021-10-14T22:27:11Z")
When adding the Osquery Manager to a policy, I get the following error and the Elastic-Agent remains on UNHEALTHY until i remove the integration from the policy. The file doesn't exist on the repository, is it missing ? … --- ## [OSQuery Manager Integration Mapping IP (\`host.ip\`) as Keyword](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [September 3, 2021, 12:33pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225 "2021-09-03T12:33:16Z")
Hi All, I'm using Fleet with the OSQuery Manager integration for 7.14.0, and I noticed that the data stream it created logs-osquery\_manager.result-default is mapping the host.ip field as a keyword. This is causing an is… --- ## [Cannot install osquery-manager](https://discuss.elastic.co/t/cannot-install-osquery-manager/281311)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 11:36am UTC](https://discuss.elastic.co/t/cannot-install-osquery-manager/281311 "2021-08-13T11:36:39Z")
Hi, I have deployed elasticsearch + kibana + package registry in the air-gap environment. However, I am having problem deploying the osquery-manager to my agent. Below is the error at my agent. {"log.level":"info","@ti… --- ## [OSQuery Live Queries don't go through](https://discuss.elastic.co/t/osquery-live-queries-dont-go-through/274428)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 14\ **Last updated:** [June 17, 2021, 9:31pm UTC](https://discuss.elastic.co/t/osquery-live-queries-dont-go-through/274428 "2021-06-17T21:31:07Z")
Hey, I'm using a 7.13 stack with 7.13 Elastic Agents on multiple machines. I have the OSQuery Manager Integration installed (v. 0.2.3) and applied a respective policy to three Agents (2x Ubuntu 20.04, 1x Windows Server … --- ## [Osquery Manager Feedback - Live Query - All Agents](https://discuss.elastic.co/t/osquery-manager-feedback-live-query-all-agents/274001)
**Author:** [@n3k0](https://discuss.elastic.co/u/n3k0)\ **Replies:** 2\ **Last updated:** [May 26, 2021, 7:39pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-live-query-all-agents/274001 "2021-05-26T19:39:53Z")
I upgraded from 7.12 to 7.13 and all of my previous fleet agents were automatically unenrolled. Which is cool. However, when I run a live query and select "All Agents", it shows as if it's going to query the five enroll… --- ## [Osquery Manager Feedback - Linux AARCH64 - Raspberry Pi](https://discuss.elastic.co/t/osquery-manager-feedback-linux-aarch64-raspberry-pi/274003)
**Author:** [@n3k0](https://discuss.elastic.co/u/n3k0)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 12:59pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-linux-aarch64-raspberry-pi/274003 "2021-05-26T12:59:18Z")
I used Linux AARCH64 successfully to install the elastic agent on two of my raspberry pi's. Which is fantastic. I wasn't expecting it to work. However, osquery searches don't appear to be working against both raspberry …