Title
#fleet
z

zahida naeem

08/22/2022, 8:11 AM
hi i am performing file integrating monitoring using osqueryd this is my config file { "options": { "config_plugin": "filesystem", "logger_plugin": "filesystem", "logger_path": "/var/log/osquery", "pidfile": "/var/osquery/osquery.pidfile" }, "schedule": { "file_events": { "query": "select * from file_events;", "interval": 30 } }, "file_paths": { "root": [ "/%" ] } } this is my flag file --config_plugin=filesystem --config_path=/etc/osquery/osquery.conf --logger_plugin=filesystem --logger_path=/var/log/osquery --disable_logging=false --log_result_events=true --schedule_splay_percent=10 --pidfile=/var/osquery/osquery.pidfile --events_expiry=3600 --database_path=/var/osquery/osquery.db --verbose=false --worker_threads=2 --disable_events=false --disable_audit=false --audit_allow_config=true --host_identifier=hostname --enable_syslog=true --audit_allow_sockets=true --schedule_default_interval=3600 i am using this command to run my osueryd sudo osqueryd --config_path /etc/osquery/osquery.example.conf now when i change the content of the file i created for the test purpose in the specified path to be monitored, i don't see any record in file_events table neither in log files
Kathy Satterlee

Kathy Satterlee

08/22/2022, 3:08 PM
Hi, @zahida naeem! If that's the exact command you're using, it looks like you're missing the
=
.
—config_path=/path/to/file.conf
5:02 PM
It's been pointed out to me that this likely isn't the issue here 🙂 Based on the paths you have set here:
"file_paths": {
    "root": [
      "/%"
    ]
You'll only see changes in files that are directly in the root path. Is that where your test file is located?
z

zahida naeem

08/23/2022, 9:17 AM
but still i'm getting no record in file_events table
s

sharvil

08/23/2022, 9:51 AM
hey @zahida naeem it seems you are missing,
--enable_file_events=true
in your flags (sorry if it's already there and I missed it), can you also add
--verbose
to turn on verbose logging in care there are any debug messages
Keith Swagler

Keith Swagler

08/23/2022, 12:35 PM
Hi Zahida, for that test file you would need to add a % to the Downloads folder path like this
"tmp": [ "/home/slyb/Downloads/%", "/tmp/%" ]
s

sharvil

08/23/2022, 4:22 PM
I do see that file_event listener is been successfully added, and that it’s also executing the scheduled file_events query..
4:23 PM
the only thing I can think of is does osquery have enough permissions to access those files? can you run osquery as root and try?
z

zahida naeem

08/23/2022, 4:41 PM
how to access those files in osquery?
Keith Swagler

Keith Swagler

08/23/2022, 4:44 PM
you can test the permission by running
select * from file where path = $testfile
s

sharvil

08/23/2022, 4:44 PM
I am not sure I understand your question, but the results of that scheduled
file_events
query would be in
/var/log/osquery/results.log
, is that not the case?
4:58 PM
Hrm, I am not quite sure but here’s what I would do next to further debug/troubleshoot: • try running
osquery
as root, so that it has permission to the files you want monitored • disable all other queries and packs for now, and just schedule the file events query • make sure the file you want monitored are less than 50MB in size (or adjust with
--read_max
flag)
Keith Swagler

Keith Swagler

08/23/2022, 5:42 PM
I have 2 other steps for you 1 remove the scheduled query for file_events and trying running it manually (after deleting and recreating file) 2 check the
osqueryd.snapshots.log
file under
/var/log/osquery/
z

zahida naeem

08/23/2022, 5:52 PM
when i run it manually i got the following error table file_events is event based but events are disabled
s

sharvil

08/23/2022, 5:54 PM
are you using osqueryi? you will need to pass in the same flags (disable_events=false and enable_file_events=true)
z

zahida naeem

08/24/2022, 4:42 PM
ok,I ran the osqueryi passing these flags and i got the desired result 🙂 but the problem is i'm doing it manually everytime i create or modify a file ...that's why i added this query in osquery config file so that it can be scheduled but the probelm the daeom is running this query but not storing result anywhere
4:43 PM
so is there a way that to get the same output in log file? through daemon
Kathy Satterlee

Kathy Satterlee

08/24/2022, 4:46 PM
Just to clarify, are you running
osqueryi
as root there?
z

zahida naeem

08/24/2022, 4:47 PM
yes
5:32 PM
any solution?
Kathy Satterlee

Kathy Satterlee

08/24/2022, 5:50 PM
It definitely looks like it should be showing up now. Has the scheduled query triggered since making the changes? Do you get any results if you run a live query?
z

zahida naeem

08/24/2022, 6:34 PM
problem resolved🤩 i created a pack of fim and added in my config file and it works as a charm
6:35 PM
thankyou all for your cooperation