i'm really struggling to get started with osquery- I've already read the kolide post linked above . . .but it's not really helping. Is there anything else that breaks it down more simply?
For example, I've got osquery installed, and I can run queries from osqueryi . . . .but osqueryd isn't logging anything and every time I try to enable one of the default query packs,
osquerycli config-check
tells me the json in the conf file is invalid.