Here's a working config: ``` { "options": { ...
# general
t
Here's a working config:
Copy code
{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "logger_path": "/var/log/osquery",
    "disable_logging": "false",
    "schedule_splay_percent": "10",
    "utc": "true"
  },
  "schedule": {
    "system_info": {
      "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
      "interval": 3600
    },
    "Host_name_of_computer":{
      "query": "SELECT hostnames, model FROM etc_hosts;",
      "interval": 216000
    },
    "Logged_in_users":{
      "query": "SELECT user, model FROM logged_in_users;",
      "interval": 3600
    }
  },
  "decorators": {
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;",
      "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
    ]
  },
  "packs": {
     //"osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
     //"incident-response": "/usr/share/osquery/packs/incident-response.conf",
     //"it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
     //"osx-attacks": "/usr/share/osquery/packs/osx-attacks.conf",
     // "vuln-management": "/usr/share/osquery/packs/vuln-management.conf",
     //"hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
     // "ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
  }
}
The `Host_name_of_computer`'s interval is a bit high, 60*60*60s