Vlad Previn
08/04/2022, 7:18 AMOsquery->logging
statusPlugin: pubsub
resultPlugin: pubsub
however if I’m not mistaken we still seem to get pod stdout containing osquery result and status logs 😞 mixed with system logs for fleet
is there a way to exclude osquery status and result logs from stdout ?Kathy Satterlee
08/04/2022, 4:44 PMstdout
logs for Fleet itself should only include the server logs. It's not uncommon to pipe those logs to a file and then set up a file watcher to send the logs wherever they need to go.Benjamin Edwards
08/04/2022, 5:20 PMVlad Previn
08/05/2022, 2:20 AM{
"snapshot": [
{
"name": "Google Chrome Helper (GPU)",
"pid": "5435",
"used": "1337.9200000000001"
},
{
"name": "Google Chrome Helper (Renderer)",
"pid": "93236",
"used": "996.90999999999997"
},
{
"name": "WindowServer",
"pid": "578",
"used": "956.13"
},
{
"name": "Slack Helper (GPU)",
"pid": "5384",
"used": "414.06"
},
{
"name": "Google Chrome",
"pid": "5335",
"used": "321.97000000000003"
}
],
"action": "snapshot",
"name": "pack/Global/Most memory intensive processes",
"hostIdentifier": "xxxxxxxxxxxxxxxxxxxxxxxxxx",
"calendarTime": "Wed Aug 3 16:42:33 2022 UTC",
"unixTime": 1659544953,
"epoch": 0,
"counter": 0,
"numerics": false,
"decorations": {
"host_uuid": "xxxxxxxxxxxxxxxxxxB",
"hostname": "xxxxxxxxxxxxxxxxx"
}
}