Hey @thedrow, want to clarify a bit, do you mean you cannot affect the schedule or configured packs via the 'distributed' query endpoints?

It seems that the distributed API does not allow to set the packs configured for an osqueryd process. The API only affects the schedule.

If you use remote configuration you can do this though correct? Remote configuration can also be set to update periodically.

I am using remote configuration. Packs are not being set.

I'd like to bump this issue. I've been trying to configure packs using the TLS configuration, and the client logs these requests as:

config.cpp:683] Error reading the query pack named: osx-attacks

While if you'd use the exact same osquery.conf from filesystem it functions fine.

Bumping this issue since I am experimenting the same issue. Running osquery 4.2.0 and using the sample files /usr/share/osquery/packs/osquery-monitoring.conf and /usr/share/osquery/packs/incident-response.conf. Using the same files from a local configuration the packs are loaded properly.

Configuration used:

{
  "options": {
    "schedule_splay_percent": 0,
    "verbose": true
  },
  "schedule": {
    "uptime": {
      "query": "SELECT * FROM uptime;",
      "interval": 60
    }
  },
  "packs": {
    "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
    "incident-response": "/usr/share/osquery/packs/incident-response.conf"
  }
}

While using the local configuration and provided with --config_path, it loads and queries start running:

I0515 03:07:00.921052 19669 scheduler.cpp:96] Executing scheduled query pack_osquery-monitoring_osquery_info: select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
I0515 03:07:00.967929 19669 scheduler.cpp:159] Found results for query: pack_osquery-monitoring_osquery_info

While using TLS plugin to deliver the same configuration, the error is the same as mentioned above:

W0515 03:16:55.525812 20306 config.cpp:687] Error reading the query pack named: osquery-monitoring
W0515 03:16:55.525852 20306 config.cpp:687] Error reading the query pack named: incident-response

Note that using the content of those files, and just pasting it as a JSON object, to be delivered as configuration, it works as expected so it must be a problem with reading the external file.