I am a noob to osquery - please excuse if the usage of 'plugin' and 'extension' in the following text are incorrect. osquery service is stopped and the interactive shell is started using the Administrator Command Prompt as

osqueryi --verbose --nodisable_extensions --disable_logging=false --flagfile="c:\Program Files\osquery\osquery.flags" --S --config_path="c:\Program Files\osquery\osquery.conf"

I am using https://github.com/osquery/osquery-go/blob/master/examples/config/main.go to create a config plugin for osquery under Windows 10. From a normal command prompt, this plugin is launched as below (assume the socket as given in the arg below)

go run .\main.go --socket  \\.\pipe\shell.em

The osquery_extensions table shows that the config plugin is loaded. But the osquery_schedule does not show the scheduled queries from the GenerateConfig function in the above main.go file. The results log file does not contain the query results too. Is there anything I am missing?

No worries being new, welcome aboard!

@seph Thank you for the points. I did not need the

--extensions_require

but I was able to get it working with the osqueryi. Now as you said about the weirdness 🙂 , proceeding with these inputs for osquery service. Will update here the details once I get it working with osquery service.

You need

--extensions_require

if your using osqueryd. Otherwise startup can create race conditions between waiting for the config plugin and requesting the config

Hey, I missed providing my update here, in case someone finds it useful. The config plugin worked, thank you for your help @seph osquery.flags contents are:

--logger_plugin=filesystem
--logger_path=D:\test\
--extensions_socket=\\.\pipe\myshelltest.em

I was sanity testing with osqueryi.exe from the command-line, and the following command works with the above flags file.

osqueryi.exe -S ^
	--disable_extensions=false ^
	--allow_unsafe ^
	--flagfile="c:\Program Files\osquery\osquery.flags" ^
	--disable_logging=false ^
	--extension c:\osquery\build\external\examples\config_plugin\RelWithDebInfo\config_plugin_extension.ext.exe ^
	--config_plugin example ^
	--force=false ^
	--extensions_socket="\\.\pipe\myshelltest.em" ^
	--verbose

Now the extension is loaded, logs are available at the given folder. I spent a lot of wasted days because I was using the following command, which fails.

...
	--extensions_socket="\\.\pipe\myshelltest.em" ^
	--verbose ^

Note that the ^(caret) and then an empty line was for convenience to be able to rearrange the parameters. But the last line in the Windows command with a ^(caret) fails the command.