09/16/2022, 4:23 PM
Hello everyone! I was wondering: what should I exactly do for osquery to “recognise” a new publisher? I will explain: I have created a new publisher on the “model” of the auditeventpublisher. I have declared and registered it with
andREGISTER macros. Overridden all the virtual methods etc. Set it to return a failure status from
so that I could see the “wiring” succeeding. I was expecting this to be enough but I don’t see it registered or even failing as expected. :headdesk: Nothing seems working. Any suggestion ?
4:37 PM
UPDATE: I literally just managed to register it. it is a starting point