Ah. Awhile ago I ran into a weird thing. My plist ...
# general
s
Ah. Awhile ago I ran into a weird thing. My plist had had
Disabled: true
once, and then the default osquery stuff wouldn't start it. I needed to add
-w
to a launchctl line.
Copy code
brannon:~ seph$ sudo /usr/local/bin/osqueryctl start
/Library/LaunchDaemons/com.facebook.osqueryd.plist: Service is disabled

brannon:~ seph$ sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
/Library/LaunchDaemons/com.facebook.osqueryd.plist: Service is disabled

brannon:~ seph$ sudo launchctl load -w /Library/LaunchDaemons/com.facebook.osqueryd.plist
brannon:~ seph$ sudo /usr/local/bin/osqueryctl status
com.facebook.osqueryd is running. pid: 2693