This message was deleted.

Hello @wennan.he, with portal I suppose you mean a fleet manager? That been said, osquery can connect to a fleet manager and pull new configurations that are overwriting the ones present on the local configuration file. If the osqueryi shell doesn’t connect to the fleet manager, then it will only use the local config. Also remember that

osqueryi

is just really

osqueryd

with another name, so it’s not connecting to a running instance of osquery, it’s launching a new one