I am relatively new to osquery and I have a need ...
# general
k
I am relatively new to osquery and I have a need to identify all failed connection attempts emanating from the host. For instance, i try to connect to an IP address on port 80 with a non existent web server and I get a connection reset. I want this to be logged in OSquery. I have configured osqueryd to capture all socket_events. I can see different socket_events being logged, but not the connection failures. Is this not supported? What do i need to detect this? Thanks in advance.