Ted Dorosheff02/02/2022, 12:56 AM
key. My osquery.conf file basically is in this format: options <stuff> file_paths <list of linux file paths> overrides platforms windows options <same stuff as above> file_paths <windows file paths> exclude_paths <windows file paths> darwin options <same stuff as above> file_paths <mac file paths> When i start my daemon on a mac, i only see the linux file paths being loaded. My config is syntactically correct, osquery isn't barfing on it.
is only a Fleet thing. When you provide this as the agent options in Fleet, it will provide the appropriate platform configuration to osquery when it checks in for config.
Ted Dorosheff02/02/2022, 12:59 AM
section to JSON and then provide that to osquery -- that would be essentially what Fleet does.
Ted Dorosheff02/02/2022, 1:02 AM