Osquery keeps executing the query without finishing.

[a11g0rhythm]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

50

Storage for /

1tb

Storage for /nsm

1tb

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
Osquery keeps executing the query without finishing. Where logs from osquery are stored ?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

How many Elastic endpoint agents have you deployed?

Are they all connected to the same network?

If you look at Elastic Fleet, do all agents show as Healthy?

Are you able to share any screenshots from Osquery Manager or Elastic Fleet?

Take a look at the Elastic Fleet logs at:
/opt/so/log/elasticfleet