curiosity
07/12/2018, 7:28 PMsudo service osqueryd stop and then sudo truncate -s0 /var/log/osquery/osqueryd.results.log and then sudo $EDITOR /var/log/osquery/osqueryd.results.log and insert text of my choice E.G.: this is a test that will show up in sumologic in a few seconds... then i see the text in sumologic.
however, when i sudo service osqueryd start and then sudo cat /var/log/osquery/osqueryd.results.log i see that osquery has started to add query results to the file... but nothing shows up in sumologic.