Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
fleetd_logs
Returns the logs from fleetd's current session. Logs are stored in memory, so they are erased when it restarts.
Column | Type | Description |
---|---|---|
error | text | The error attached to the event |
level | text | The log-level of the event. Info, Debug, etc. |
message | text | The message attached to the event |
payload | text | Any extra data attached to the event, JSON |
time | text | The time the event was captured, UTC. |
SELECT * FROM fleetd_logs
Return only log entries with errors attached
SELECT * FROM fleetd_logs WHERE error != ""