https://github.com/osquery/osquery logo
Title
a

allister

03/26/2023, 10:23 AM
1. I’d think you only should need to reload the daemon of you’re not using a sync server where the client polls for a configuration-related update 2. The interval is a pretty simple counter that I believe starts with the daemon, so I would expect it to restart in that case
k

Kiwito

03/26/2023, 5:51 PM
Thanks allister, I distribute
conf
files semi manually. What I understand is I should look for using sync server? I couldn't find anything on documentation related to that. Can you give me a hint, please?
a

allister

03/28/2023, 2:03 PM
people can get perfectly far along without a sync server, it's just a lot simpler because osquery itself can act as a log shipper. Fleet, Kolide, Zentral (what I use), Uptycs, there's a bunch of server products out there with their various differences in enhancements over the basic spec like bundled extensions and SIEM integrations
k

Kiwito

03/28/2023, 2:16 PM
Oh I see what you mean now. I don't want to rely on any other tool to use a tool. In this case I will go for a workaround to restart daemon whenever I make any change. Thanks for info.