Ibra
08/01/2022, 12:06 AMStefano Bonicatti
08/01/2022, 8:37 AMosquery/osquery
builds osquery and then installs it in a folder together with all the files needed. Then the code in the repo osquery/osquery-packaging
, takes whatever it’s in that folder and creates the MSI.
What goes in the initial install folder is driven by https://github.com/osquery/osquery/blob/master/cmake/install_directives.cmake, but instead of modifying that you can have CMake include your own by specifying the OSQUERY_INSTALL_DIRECTIVES
option at configure time, pointing to a different .cmake
.
Keep in mind that the install_directives.cmake
file doesn’t just copy files that will be included in the MSI, but there’s also a WiX patch file which helps constructing the MSI itself.
If you want to then modify other things of the MSI itself, then you most likely need to edit the CMake code in the osquery/osquery-packaging
repo.Ibra
08/01/2022, 9:07 AMsharvil
08/01/2022, 10:03 AMalso changing the daemon name from osqueryd to exp-osquery. is it possible?I don't think this is currently possible
Ibra
08/01/2022, 10:04 AMsharvil
08/01/2022, 10:07 AMcan the daemon have 2 different flag files and send data to 2 different fleet servers? (edited)Not for the same
osqueryd
process, I think it might be possible for another distinct osqueryd
process from a different path thoughIbra
08/01/2022, 10:10 AMsharvil
08/01/2022, 10:40 AMIbra
08/01/2022, 10:44 AMStefano Bonicatti
08/01/2022, 11:06 AM--pidfile
flag and a different database path with --database_path
, also ensuring that the config file in the installation doesn’t touch those flags, or just provide a separate config file with --config_path
; that’s what would cause launching a second instance of osquery to fail. You can also create 2 services that points to the same osquery binary, with different names and those different flags.