Andrew Zah
08/27/2019, 8:03 PMI0827 16:00:20.485584 26049 scheduler.cpp:100] Executing scheduled query hardware_events: SELECT * from hardware_events;
I0827 16:00:20.504634 26049 killswitch.cpp:60] osquery::Killswitch::IsEnabledError 1 (Cannot call registry item: )
I0827 16:00:20.504743 26049 profiler.cpp:64] rusage field "scheduler.executing_query.hardware_events.success.input.load" is not supported
I0827 16:00:28.486793 26049 scheduler.cpp:100] Executing scheduled query processes: SELECT name, path, cmdline, state from processes;
I get this when trying to run these queries in osqueryd:
"schedule": {
"processes": {
"query": "SELECT name, path, cmdline, state from processes;",
"interval": 10
},
"hardware_events": {
"query": "SELECT * from hardware_events;",
"interval": 10
}
},