I have been testing some cases. in this respect......
# general
m
I have been testing some cases. in this respect... 1- TLS server (fleet) is turned off 2- osquery.flag file of the agent is containing the following flags related to timing --config_refresh=5 --config_accelerated_refresh=15 --config_tls_max_attempts=2 3- run the CLI command on the osquery agent \ProgramData\osquery\osqueryd\osqueryd.exe --flagfile=\ProgramData\osquery\osquery.flags --verbose --tls_dump the outputs is attached as a snippet. we see that osqueryd.exe has ended after a while and we only see these outputs in CLI, we can’t see them while it is running as a windows service. in this case when the fleet isn’t accessible, is it right approach for the osquery?