I made what I thought was a minor edit (enabling some packs) in

/etc/osquery/osquery.conf

and now

osqueryd

will not start. I think the json checks out using

cat /etc/osquery/osquery.conf | jq '.'

, however using

osqueryi --verbose --config_check --config_path=/etc/osquery/osquery.conf

reveals:

I1130 10:28:21.822659  8351 init.cpp:396] osquery initialized [version=3.2.6]
I1130 10:28:21.822727  8351 extensions.cpp:342] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load
I1130 10:28:21.822823  8351 init.cpp:633] Cannot start extension manager: Extensions disabled
I1130 10:28:21.822842  8351 auto_constructed_tables.cpp:85] Removing stale ATC entries
I1130 10:28:21.845922  8351 smbios_tables.cpp:102] Reading SMBIOS from sysfs DMI node

The file

/etc/osquery/extensions.load

has never existed. What should I be looking at next?