Jason NG
06/10/2021, 9:36 AMHi, new here and using osquery for the first time. I dont understand why with the config file i have, i dont see the results being outputted to the file /var/log/osquery/osquery.results.log even though i can see the schedule being executed. However, if i add snapshot to the schedule portion, it appears in the /var/log/osquery/osquery.snapshots.log file. Am i missing something here?
{
"options":{
"config_plugin":"filesystem",
"logger_plugin":"filesystem",
"utc":"true"
},
"schedule":{
"system_info":{
"query":"SELECT hostname, cpu_brand, physical_memory FROM system_info;",
"interval":60
}
},
"decorators":{
"load":[
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
]
}
}