Hi guys, I just installed OSQuery on Mac. I kicked...
# macos
k
Hi guys, I just installed OSQuery on Mac. I kicked osqueryd but I see following errors. I noticed there are similar posts and comments, but I see no one has really solved the problem. If anyone has any clue, it will be really helpful.
Copy code
% sudo osqueryd --config_path /var/osquery/osquery.json --disable_events=false --debug=true
Password:
I0906 22:05:15.825022 2905318336 init.cpp:392] osquery initialized [version=2.7.0]
I0906 22:05:15.863698 2905318336 system.cpp:322] Found stale process for osqueryd (89870)
I0906 22:05:15.864281 2905318336 system.cpp:357] Writing osqueryd pid (90207) to /var/osquery/osqueryd.pidfile
I0906 22:05:15.866744 10493952 watcher.cpp:513] osqueryd watcher (90207) executing worker (90208)
I0906 22:05:15.885294 2905318336 init.cpp:389] osquery worker initialized [watcher=90207]
I0906 22:05:15.886271 2905318336 rocksdb.cpp:214] Opening RocksDB handle: /var/osquery/osquery.db
I0906 22:05:16.378697 223260672 interface.cpp:327] Extension manager service starting: /var/osquery/osquery.em
I0906 22:05:16.400635 2905318336 preferences.cpp:281] Cannot find/read defaults plist from path: /private/var/db/receipts/com.facebook.osquery.kernel.plist
I0906 22:05:16.401119 2905318336 events.cpp:824] Event publisher failed setup: kernel: Cannot access /dev/osquery
I0906 22:05:16.401139 2905318336 events.cpp:824] Event publisher failed setup: openbsm: Publisher disabled via configuration
I0906 22:05:16.401149 2905318336 events.cpp:824] Event publisher failed setup: scnetwork: Publisher not used
I0906 22:05:16.401217 2905318336 events.cpp:1077] Error registering subscriber: process_file_events: No kernel event publisher
I0906 22:05:16.401582 2905318336 daemon.cpp:37] Not starting the distributed query service: Distributed query service not enabled.
I0906 22:05:16.401672 223797248 events.cpp:745] Starting event publisher run loop: diskarbitration
I0906 22:05:16.401711 224333824 events.cpp:745] Starting event publisher run loop: fsevents
I0906 22:05:16.401808 224870400 events.cpp:745] Starting event publisher run loop: iokit