Hello, I noticed that when

orbit

starts

osqueryd

on macOS, it sets `--disable_carver=false`:

% ps -ax | grep osquery
87960 ??         0:00.06 /opt/orbit/bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd --pidfile=/opt/orbit/osquery.pid --database_path=/opt/orbit/osquery.db --extensions_socket=/opt/orbit/orbit-osquery.em --logger_path=/opt/orbit/osquery_log --enroll_secret_env ENROLL_SECRET --host_identifier=uuid --tls_hostname=<http://glycine.wesleyan.edu|glycine.wesleyan.edu> --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --tls_server_certs /opt/orbit/certs.pem --augeas_lenses /opt/orbit/lenses --force --flagfile /opt/orbit/osquery.flags

In an attempt to disable file carving, I added

--disable_carver=true

to `osquery.flags`:

% sudo cat /opt/orbit/osquery.flags
--disable_carver=true

Then restarted `orbit`:

sudo launchctl unload /Library/LaunchDaemons/com.fleetdm.orbit.plist
sudo launchctl load /Library/LaunchDaemons/com.fleetdm.orbit.plist

However, when

orbit

starts

osqueryd

, it still passes the

--disable_carver=false

flag. If there's a conflict between the command-line flags and the contents of

--flagfile

, which wins? Does it matter which order they're specified? Is there a way to tell for sure that carving is disabled? Thanks!

Hey @Colin Smith, Believe flags in

osquery.flags

are applied last. If you run a

SELECT description, name, value FROM osquery_flags WHERE name='disable_carver';

on the endpoint does it return true?

I ran that from the fleet server and

disable_carver

was indeed set to true on the one host I modified and false on all the others. Thanks!

Hi. For my case, I am adding the watchdog_memory_limit flag. It showed correctly as I change when I query from fleet console. But from the osquery shell console inside the machine, it is not showing