Hello everyone! I am trying osquery and in particu...
# general
b
Hello everyone! I am trying osquery and in particular I wanted to configure the syslog. I make the configuration following the guide, and I see rsyslog writing in the pipe, but still the table syslog and syslog_events are empty. This is the content of the table osquery_events
Copy code
osquery> select * from osquery_events;
+---------------------+---------------------+------------+---------------+--------+-----------+--------+
| name                | publisher           | type       | subscriptions | events | refreshes | active |
+---------------------+---------------------+------------+---------------+--------+-----------+--------+
| auditeventpublisher | auditeventpublisher | publisher  | 3             | 0      | 24        | 1      |
| inotify             | inotify             | publisher  | 0             | 0      | 24        | 1      |
| syslog              | syslog              | publisher  | 1             | 0      | 0         | 0      |
| udev                | udev                | publisher  | 1             | 0      | 24        | 1      |
| file_events         | inotify             | subscriber | 0             | 0      | 0         | 1      |
| hardware_events     | udev                | subscriber | 1             | 0      | 0         | 1      |
| process_events      | auditeventpublisher | subscriber | 1             | 0      | 0         | 1      |
| process_file_events | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
| selinux_events      | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
| socket_events       | auditeventpublisher | subscriber | 1             | 0      | 0         | 1      |
| syslog_events       | syslog              | subscriber | 1             | 0      | 0         | 1      |
| user_events         | auditeventpublisher | subscriber | 1             | 0      | 0         | 1      |
| yara_events         | inotify             | subscriber | 0             | 0      | 0         | 1      |
+---------------------+---------------------+------------+---------------+--------+-----------+--------+