IDH: osquery not updating

[cmengle-ipc]

I'm experimenting with Fleet in SO 2.3.220 and I noticed the osquery version for the IDH node isn't updating, stuck at 4.5.1. Is this normal or should osquery update to the current version (5.7.0). Please let me know if anyone has experienced the same issue or can point me in the right direction. Thanks in advance!

[cm-ops]

What outputs when you run /usr/local/so-launcher/bin/osqueryd-updates/$RANDOM_DIR/osqueryd --version with $RANDOM_DIR being numbers in the actual path.

[cmengle-ipc]

Segmentation fault

However, the osqueryd at /usr/local/so-launcher/bin
$ ./osqueryd --version
osqueryd version 4.5.1

[cm-ops]

Try the following: rm -rf /usr/local/so-launcher/bin/osqueryd-updates/ and wait to see if the updates are downloaded and applied.

[cmengle-ipc]

Removing the directory hasn't helped. Are there any instructions for manually updating osquery? I want to avoid having to reinstall the IDH since alerts and everything else appears to be working as expected. My only issue is an old osquery version, maybe a corrupt package or something I'm missing. Appreciate the help.

[cm-ops]

You could try this #8026 (reply in thread) and see if that solves the updating issue.

[cmengle-ipc]

I took a little different approach and the update worked. I extracted osqueryd from the staging tar file, overwriting the old version in /usr/local/so-launcher/bin, then restarted the launcher service on the IDH node and also the Manager Node for good measure. Many thanks for the support!

From the below, you can see the /usr/local version was not being updated. I've included the commands I used for reference, hope it will help someone else.

root@server01:/usr/local/so-launcher/bin# ./osqueryd --version
osqueryd version 4.5.1

root@server01:/usr/local/so-launcher/bin# ls -l
total 55516
-rwxr-xr-x 1 root root 18562788 Nov 17 2020 launcher
-rwxr-xr-x 1 root root 31265272 Nov 17 2020 osqueryd
-rwxr-xr-x 1 root root 7013874 Nov 17 2020 osquery-extension.ext

root@server01:/usr/local/so-launcher/bin# tar xvf /var/so-launcher/securityonion/osqueryd-staging/linux/osqueryd-stable.tar.gz
osqueryd

root@server01:/usr/local/so-launcher/bin# ls -l
total 75020
-rwxr-xr-x 1 root root 18562788 Nov 17 2020 launcher
-rwxr-xr-x 1 root root 51238000 Jan 1 1970 osqueryd
-rwxr-xr-x 1 root root 7013874 Nov 17 2020 osquery-extension.ext

root@server01:/usr/local/so-launcher/bin# ./osqueryd --version
osqueryd version 5.7.0

root@server01:/usr/local/so-launcher/bin# systemctl restart launcher.so-launcher.service

root@server01:/usr/local/so-launcher/bin# systemctl status launcher.so-launcher.service