Hello!Osquery does not write a log. What is the error? { // Configure the daemon below: "options": { // The log directory stores info, warning, and errors. // If the daemon uses the 'filesystem' logging retriever then the log_dir // will also contain the query results. "logger_path": C:\Program Files\osquery\, // Set 'disable_logging' to true to prevent writing any info, warning, error // logs. If a logging plugin is selected it will still write query results. //"disable_logging": "false", // Splay the scheduled interval for queries. // This is very helpful to prevent system performance impact when scheduling // large numbers of queries that run a smaller or similar intervals. //"schedule_splay_percent": "10", }, // Define a schedule of queries: "schedule": { // This is a simple example query that outputs basic system information. "system_info": { // The exact query to run. "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;", // The interval in seconds to run this query, not an exact interval. "interval": 3600 } }, // Decorators are normal queries that append data to every query. "decorators": { "load": [ "SELECT uuid AS host_uuid FROM system_info;", "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;" ] }, // Add default osquery packs or install your own. // // There are several 'default' packs installed via // packages and/or Homebrew. // // Linux: /opt/osquery/share/osquery/packs // OS X: /var/osquery/packs // Homebrew: /usr/local/share/osquery/packs // make install: {PREFIX}/share/osquery/packs C:\Program Files\osquery\packs "packs": { // "osquery-monitoring": "/opt/osquery/share/osquery/packs/osquery-monitoring.conf", // "incident-response": "/opt/osquery/share/osquery/packs/incident-response.conf", // "it-compliance": "/opt/osquery/share/osquery/packs/it-compliance.conf", // "osx-attacks": "/var/osquery/packs/osx-attacks.conf", // "vuln-management": "/opt/osquery/share/osquery/packs/vuln-management.conf", // "hardware-monitoring": "/opt/osquery/share/osquery/packs/hardware-monitoring.conf", // "ossec-rootkit": "/opt/osquery/share/osquery/packs/ossec-rootkit.conf", "windows-hardening": "C:/Program Files/osquery/packs/windows-hardening.conf", "windows-attacks": "C:/Program Files/osquery/packs/windows-attacks.conf", "incident-response": "C:/Program Files/osquery/packs/incident-response.conf", "it-compliance": "C:/Program Files/osquery/packs/it-compliance.conf", "osquery-monitoring": "C:/Program Files/osquery/packs/osquery-monitoring.conf", "unwanted-chrome-extensions": "C:/Program Files/osquery/packs/unwanted-chrome-extensions.conf", "windows-hardening": "C:/Program Files/osquery/packs/windows-hardening.conf" }, // Provides feature vectors for osquery to leverage in simple statistical // analysis of results data. // // Currently this configuration is only used by Windows in the Powershell // Events table, wherein character_frequencies is a list of doubles // representing the aggregate occurrence of character values in Powershell // Scripts. A default configuration is provided which was adapated from // Lee Holmes cobbr project: // https://gist.github.com/cobbr/acbe5cc7a186726d4e309070187beee6 // "feature_vectors": { "character_frequencies": [ 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.00045, 0.01798, 0.0, 0.03111, 0.00063, 0.00027, 0.0, 0.01336, 0.0133, 0.00128, 0.0027, 0.00655, 0.01932, 0.01917, 0.00432, 0.0045, 0.00316, 0.00245, 0.00133, 0.001029, 0.00114, 0.000869, 0.00067, 0.000759, 0.00061, 0.00483, 0.0023, 0.00185, 0.01342, 0.00196, 0.00035, 0.00092, 0.027875, 0.007465, 0.016265, 0.013995, 0.0490895, 0.00848, 0.00771, 0.00737, 0.025615, 0.001725, 0.002265, 0.017875, 0.016005, 0.02533, 0.025295, 0.014375, 0.00109, 0.02732, 0.02658, 0.037355, 0.011575, 0.00451, 0.005865, 0.003255, 0.005965, 0.00077, 0.00621, 0.00222, 0.0062, 0.0, 0.00538, 0.00122, 0.027875, 0.007465, 0.016265, 0.013995, 0.0490895, 0.00848, 0.00771, 0.00737, 0.025615, 0.001725, 0.002265, 0.017875, 0.016005, 0.02533, 0.025295, 0.014375, 0.00109, 0.02732, 0.02658, 0.037355, 0.011575, 0.00451, 0.005865, 0.003255, 0.005965, 0.00077, 0.00771, 0.002379, 0.00766, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0 ] } }