GUWILLL
10/10/2023, 4:56 PMCannot activate filesystem logger plugin: Could not create file: C:\Program Files\osquery\log\osqueryd.results.log
And here my conf file and flag file
conf file
{
"schedule": {
"system_info": {
"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
"interval": 60
},
"process_netports": {
"query": "SELECT lp.pid, p.name, lp.port, lp.address FROM listening_ports AS lp INNER JOIN processes AS p ON lp.pid = p.pid WHERE lp.port = 0 AND lp.address = \"127.0.0.1\" ORDER BY p.start_time DESC;",
"interval": 60
}
},
"decorators": {
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
]
},
"options": {
"logger_plugin": "filesystem",
"disable_logging": "false",
"logger_path": "C:\\Program Files\\osquery\\log",
"utc": "true"
}
}
flag file
--allow_unsafe
--config_path=C://Program Files//osquery//osquery.conf
--disable_events=true
--host_identifier=uuid
--verbose=true
ERROR code
PS C:\Program Files\osquery\osqueryd> .\osqueryd.exe --flagfile="../osquery.flags" I1011 01:47:11.205355 1412 init.cpp:413] osquery initialized [version=5.9.1] I1011 01:47:11.225670 1412 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: \Program Files\osquery\extensions.load I1011 01:47:11.225670 1412 dispatcher.cpp:78] Adding new service: WatcherRunner (0000021525BC5D20) to thread: 2492 (0000021523EB4EC0) in process 4272 I1011 01:47:11.237401 2492 watcher.cpp:674] osqueryd watcher (4272) executing worker (4864) I1011 01:47:11.269346 204 init.cpp:410] osquery worker initialized [watcher=4272] I1011 01:47:11.289559 204 dispatcher.cpp:78] Adding new service: UsersService (00000205F3B19DA0) to thread: 4244 (00000205F3B56960) in process 4864 I1011 01:47:11.301124 204 dispatcher.cpp:78] Adding new service: GroupsService (00000205F3B1AFB0) to thread: 4816 (00000205F3B565A0) in process 4864 I1011 01:47:11.319512 4244 users_service.cpp:149] Users cache initialized I1011 01:47:11.319512 4816 groups_service.cpp:55] Groups cache initialized I1011 01:47:11.319512 204 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (00000205F585C540) to thread: 1340 (00000205F3AA0E30) in process 4864 I1011 01:47:11.333074 204 rocksdb.cpp:90] Opening RocksDB handle: \Program Files\osquery\osquery.db I1011 01:47:11.475821 204 dispatcher.cpp:78] Adding new service: ExtensionWatcher (00000205F3A86ED0) to thread: 6056 (00000205F58B5900) in process 4864 I1011 01:47:11.491575 204 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (00000205F5924BD0) to thread: 4364 (00000205F58B5720) in process 4864 I1011 01:47:11.491575 4364 interface.cpp:299] Extension manager service starting: \\.\pipe\osquery.em I1011 01:47:11.491575 204 auto_constructed_tables.cpp:99] Removing stale ATC entries W1011 01:47:11.507668 204 options.cpp:106] The CLI only flag --logger_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup E1011 01:47:13.047991 204 shutdown.cpp:79] Cannot activate filesystem logger plugin: Could not create file: C:\Program Files\osquery\log\osqueryd.results.log I1011 01:47:13.080094 204 dispatcher.cpp:149] Thread: 204 requesting a stop I1011 01:47:13.080094 204 dispatcher.cpp:156] Service: 00000205F3B19DA0 has been interrupted I1011 01:47:13.080094 204 dispatcher.cpp:156] Service: 00000205F3B1AFB0 has been interrupted I1011 01:47:13.080094 204 dispatcher.cpp:156] Service: 00000205F585C540 has been interrupted I1011 01:47:13.100395 204 dispatcher.cpp:156] Service: 00000205F3A86ED0 has been interrupted I1011 01:47:13.100395 204 dispatcher.cpp:156] Service: 00000205F5924BD0 has been interrupted I1011 01:47:13.100395 204 dispatcher.cpp:122] Thread: 204 requesting a join I1011 01:47:13.111958 204 dispatcher.cpp:140] Service thread: 00000205F58B5720 has joined I1011 01:47:13.111958 204 dispatcher.cpp:140] Service thread: 00000205F58B5900 has joined I1011 01:47:13.111958 204 dispatcher.cpp:140] Service thread: 00000205F3AA0E30 has joined I1011 01:47:13.127772 204 dispatcher.cpp:140] Service thread: 00000205F3B565A0 has joined I1011 01:47:13.131817 204 dispatcher.cpp:140] Service thread: 00000205F3B56960 has joined I1011 01:47:13.131817 204 dispatcher.cpp:144] Services and threads have been cleared E1011 01:47:14.277684 2492 shutdown.cpp:79] Worker returned exit status I1011 01:47:14.277684 1412 dispatcher.cpp:149] Thread: 1412 requesting a stop I1011 01:47:14.277684 1412 dispatcher.cpp:122] Thread: 1412 requesting a join I1011 01:47:14.288219 1412 dispatcher.cpp:140] Service thread: 0000021523EB4EC0 has joined I1011 01:47:14.319613 1412 dispatcher.cpp:144] Services and threads have been cleared