search

kolide / fleet

A flexible control server for osquery fleets
https://kolide.com/fleet
MIT License
1.1k stars 261 forks source link

Cannot add same query to pack more than once (results in 5xx) #2202

Open nyanshak opened 4 years ago

nyanshak commented 4 years ago

What version of fleet are you using (fleet version --full)?

2.4.0

What operating system are you using?

Docker image: kolide/fleet:2.4.0

What did you do?

  1. create query 'my_awesome_query'
  2. create pack 'my_pack'
  3. (through the UI) add 'my_awesome_query' to pack, with snapshot false and interval 3600
  4. (through the UI) add 'my_awesome_query' to pack again, with snapshot true, and interval 43200

What did you expect to see?

Query added to pack twice with different schedules / intervals.

Alternately: 400 error page explaining that adding a query to a pack more than once is not supported. I don't think a 5xx response is correct.

What did you see instead?

5xx error page

zwass commented 4 years ago

Sounds like a bug.

As a workaround, I believe you can do this if you create the pack with fleetctl.