I have been testing some cases. in this respect...
1- TLS server (fleet) is turned off
2- osquery.flag file of the agent is containing the following flags related to timing
--config_refresh=5
--config_accelerated_refresh=15
--config_tls_max_attempts=2
3- run the CLI command on the osquery agent
\ProgramData\osquery\osqueryd\osqueryd.exe --flagfile=\ProgramData\osquery\osquery.flags --verbose --tls_dump
the outputs is attached as a snippet.
we see that osqueryd.exe has ended after a while and we only see these outputs in CLI, we can’t see them while it is running as a windows service. in this case when the fleet isn’t accessible, is it right approach for the osquery?