I’m seeing crashes with osqueryd. I’m not seeing a...
# macos
g
I’m seeing crashes with osqueryd. I’m not seeing anything useful in the logs - where would I start to debug this? Can I turn logging up any more?
Copy code
{
  "auto_table_construction": {
    "munki_application_usage": {
      "columns": [
        "event",
        "bundle_id",
        "app_version",
        "app_path",
        "last_time",
        "number_times"
      ],
      "path": "/Library/Managed Installs/application_usage.sqlite",
      "platform": "darwin",
      "query": "SELECT * from application_usage;"
    }
  },
  "decorators": {
    "always": [
      "SELECT \"itx_corp\" AS envIdentifier",
      "SELECT hardware_serial AS serial FROM system_info",
      "SELECT uuid as hardware_uuid FROM system_info",
      "select uuid as system_uuid from block_devices join mounts on name = device where mounts.path = \"/\"",
      "select platform from os_version"
    ]
  },
  "options": {
    "aws_access_key_id": "my_access_key",
    "aws_firehose_stream": "my_firehose_stream",
    "aws_kinesis_random_partition_key": true,
    "aws_kinesis_stream": "my_kinesis_stream",
    "aws_region": "us-east-1",
    "aws_secret_access_key": "my_access_key",
    "config_plugin": "filesystem",
    "enable_monitor": false,
    "events_expiry": 3600,
    "extensions_autoload": "/var/osquery/extensions.load",
    "extensions_interval": 3,
    "extensions_timeout": 3,
    "logger_min_status": 0,
    "logger_min_stderr": 0,
    "logger_plugin": "aws_firehose,aws_kinesis,filesystem",
    "schedule_splay_percent": 20,
    "tls_server_certs": "/var/osquery/ca.pem",
    "verbose": true,
    "worker_threads": 2
  },
  "packs": {
    "airbnb_info": "/var/osquery/packs/airbnb_info.conf",
    "airbnb_mac_os_x": "/var/osquery/packs/airbnb_mac_os_x.conf",
    "airbnb_windows": "/var/osquery/packs/airbnb_windows.conf",
    "hardware-monitoring": "/var/osquery/packs/hardware-monitoring.conf",
    "incident-response": "/var/osquery/packs/incident-response.conf",
    "osquery-monitoring": "/var/osquery/packs/osquery-monitoring.conf",
    "ossec-rootkit": "/var/osquery/packs/ossec-rootkit.conf",
    "osx-attacks": "/var/osquery/packs/osx-attacks.conf",
    "vuln-management": "/var/osquery/packs/vuln-management.conf",
    "windows-attacks": "/var/osquery/packs/windows-attacks.conf"
  },
  "schedule": {
    "info": {
      "interval": 86400,
      "query": "SELECT * FROM osquery_info;"
    }
  }
}