Need some help debugging why the osquery agent won...
# general
j
Need some help debugging why the osquery agent won't take the flagfile when installing the Windows service. I can run osquery just fine with flags file being processed, like this: PS C:\Program Files\osquery\osqueryd> .\osqueryd.exe --flagfile 'C:\Program Files\osquery\osquery.flags' --tls_dump --verbose. But when I try to install the service and have the flags file processed, and start the process, I get a service control manager error (1067). Have tried: (1) Set safe permissions and ACLS using powershell script ("osquery_utils.ps1"). (2) Have tried re-creating the 'osquery.flags' file with UTF-8 and ANSI. (3) Have tried installing service with provided powershell script (\manage-osqueryd.ps1"). I've also tried different variations of using "--flagfile C:\Program Files\osquery\osquery.flags" and "--flagfile=C:\Program Files\osquery\osquery.flags" and using single and double quotes. Currently I'm using this command to install the service: New-Service -Name "osqueryd" -BinaryPathName "C:\Program Files\osquery\osqueryd \osqueryd.exe --flagfile C:\Program Files\osquery\osquery.flags"