Hi everyone,
osquery service is not connecting with fleet server.
i have tried below commands to connect osquery service to fleet server but unable to connect to fleet server.
sc.exe create osqueryd type= own start= auto binpath= "\"C:\Program Files\osquery\osqueryd\osqueryd.exe\" --flagfile=\"C:\Program Files\osquery\osquery.flags\"" displayname= osqueryd
.\manage-osqueryd.ps1 -install -startupArgs "C:\Program Files\osquery\osquery.flags"
:"C:\Program Files\osquery\osqueryd\osqueryd.exe" --flagfile="C:\Program Files\osquery\osquery.flags" --install
Here is my flagfile (osquery.flags)
# Server
--tls_hostname=MyIP:8080
--tls_server_certs="C:\Program Files\osquery\certs\fleet.pem"
# Enrollment
--host_identifier=instance
--enroll_secret_path="C:\Program Files\osquery\certs\enroll_secret"
--enroll_tls_endpoint="C:\Program Files\osquery\"
# Configuration
--config_plugin=tls
#--config_tls_endpoint=/api/v1/osquery/config
--config_tls_endpoint="C:\Program Files\osquery\osquery.conf"
--config_refresh=10
# Live query
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint="C:\Program Files\osquery\certs\"
--distributed_tls_write_endpoint="C:\Program Files\osquery"
# Logging
--logger_plugin=tls
--logger_tls_endpoint="C:\Program Files\osquery\log"
# File carving
--disable_carver=false
#--carver_start_endpoint=/api/v1/osquery/carve/begin
#--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2000000
Please identify the issue.