is that the right place?

I'm looking for Kolide fleet launcher for Windows. could find only for linux by now.. is there anything avalibile?

@groob you around?

But I think if we clear out the program data folder on uninstall the reinstall might work. I’d bet it’s the residual .db that’s breaking things

Yeah I’ve been piping to jq, I guess I’m missing the point of osqueryi then. I was thinking of using it to gather pieces of information from machines on a recurring basis, so every fifteen minutes grab disk space, that sort of thing.

that's what's actually talking, as opposed to what might be?

@Tom Frost also consider these flags for config timing --config_refresh=30 --config_accelerated_refresh=300 --config_tls_max_attempts=30 after enrollment phase is completed if the agents can’t communicate with the fleet, in this case you need to consider these flags. if the values low in this case the agent stops trying to communicate with the fleet you can set the value of the last flag a high value

you should build with normal user, not root

We moved to letting Journald catch them through syslog and letting Journald rotation handle it

windows can run VMs

the counter won’t reset, but yeah, there should be a pretty aggressive set of added and removed rows the first time the new query gets executed

Hi Explain me what is Kolide?

Yes, that helps! that is what I actually expected - yet this is not the case I am seeing, but I still need to see whether it is a bug I introduced myself. Thanks for the quick response @rickbergfalk

@dictvm maybe ask in the #kolide channel 🙂

Hi everyone! Where can I ask for help about writing queries?

Can someone better versed with Kafka than myself hit this up? https://stackoverflow.com/questions/51058901/osquery-unknown-command-line-flagslogger-kafka-brokers-logger-kafka-topic 😄

ICYMI https://blog.trailofbits.com/2018/06/27/announcing-the-trail-of-bits-osquery-support-group/

this closed github issue from December 2016 said that it wasn't on any near-term roadmap https://github.com/facebook/osquery/issues/2815 wondering what the feels are around supporting mobile devices

Dear i have a question, i would like to enable the support to Windows Event Log, but i don't have the file osquery.man under the osquery directory ...who can help me?

@Rich5 you can change the host identifier to be ephemeral, and that’ll generate a uuid per osquery instance, but then if the daemon restarts you’ll have a new one :/

Anyone have the osquery service on windows stop after a day or two?

Osquery Workshop approved at Bsides Las Vegas ;)

Hi everyone, is there anyways to get domain_name for process_open_sockets table

Hi, I'm building a query to fetch data process_events table (previously i was using processes). I'm not able to find any column corresponding to process "name" in process_events table. "name" column is present in processes table. Is process name not supported for event based table or is there any other way to fetch the same. Thanks.

Hey, I'm testing following query with osqueryd conf : "query" : "SELECT *,REPLACE(path, (SELECT REGEX_SPLIT(path, \"[\.\w-]+$\", 0)), '' ) AS name from process_events;"

I tried single quotes as well but the issue was with \w and \. ☺️

so I am looking for best approch to osquery installation..

Hey ya'll, I've been following the instructions on https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#macos-process-auditing to try and test audit logging on macOS w/ osquery. But even with the flags set and the /etc/security/audit_control set, osquery still says that events are disabled. Is there something else I need to do on macOS?