hey all, i'm attempting to enable snapshot logs, b...
# general
a
hey all, i'm attempting to enable snapshot logs, but the snapshot log is empty. i created a simple pack to test (running on osqueryi returns results as expected):```{ "queries": { "authorized_keys_alerting": { "query": "select * from authorized_keys;", "interval": "30", "snapshot": true } } }``` between pack updates, i'm running launchtctl bootout/bootstrap on the osquery plist. when i check /var/logs/osquery.snapshot.log, my logs look like this:
Copy code
{
  "snapshot": [],
  "action": "snapshot",
  "name": "pack_authorized-keys_authorized_keys_alerting",
  "hostIdentifier": "redacted",
  "calendarTime": "Tue Jan 15 20:00:32 2019 UTC",
  "unixTime": 1547582432,
  "epoch": 0,
  "counter": 0,
  "decorations": {
    "host_uuid": "redacted",
    "username": "adaud"
  }
}