3. The below content is the log of my osqueyd and osquey.flags
The rock db was reset about 1 time/hour. I thought there is something weird. Please help to clarify this problem. Thanks.
log:
0107 06:04:56.367833 18200 tls.cpp:255] TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log
{"data":[{"hostIdentifier":"TEST","calendarTime":"Thu Jan 6 21:54:56 2022 UTC","unixTime":"1641506096","severity":"0","filename":"tls.cpp","line":"255","message":"TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log","version":"5.1.0"},{"hostIdentifier":"TEST","calendarTime":"Thu Jan 6 21:54:56 2022 UTC","unixTime":"1641506096","severity":"0","filename":"tls.cpp","line":"255","message":"TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log","version":"5.1.0"}],"log_type":"status","node_key":"TEST"}
I0107 06:06:13.025902 28024 database.cpp:130]
Resetting the database plugin: rocksdb
I0107 06:06:13.030591 28024 rocksdb.cpp:132] Opening RocksDB handle: \Program Files\osquery\osquery.db
I0107 06:14:56.424681 18200 tls.cpp:255] TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log
{"data":[{"hostIdentifier":"TEST","calendarTime":"Thu Jan 6 22:04:56 2022 UTC","unixTime":"1641506696","severity":"0","filename":"tls.cpp","line":"255","message":"TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log","version":"5.1.0"},{"hostIdentifier":"TEST","calendarTime":"Thu Jan 6 22:06:13 2022 UTC","unixTime":"1641506773","severity":"0","filename":"database.cpp","line":"130","message":"Resetting the database plugin: rocksdb","version":"5.1.0"},{"hostIdentifier":"TEST","calendarTime":"Thu Jan 6 22:06:13 2022 UTC","unixTime":"1641506773","severity":"0","filename":"rocksdb.cpp","line":"132","message":"Opening RocksDB handle:
\\Program Files\\osquery\\osquery.db","version":"5.1.0"}],"log_type":"status","node_key":"TEST"}
I0107 06:24:56.505218 18200 tls.cpp:255] TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log
{"data":[{"hostIdentifier":"TEST","calendarTime":"Thu Jan 6 22:14:56 2022 UTC","unixTime":"1641507296","severity":"0","filename":"tls.cpp","line":"255","message":"TLS/HTTPS POST request to URI:
https://TEST/tls-logging/api/v1/osquery/log","version":"5.1.0"}],"log_type":"status","node_key":"TEST"}
osquery.flags:
--force=true
--pack_refresh_interval=3600
--verbose=true
--debug=true
--tls_hostname=TEST
--tls_server_certs=C:\Program Files\osquery\TEST-CA.pem
--enroll_always
--enroll_secret_path=C:\Program Files\osquery\secret.txt
--enroll_tls_endpoint=/tls/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/tls/api/v1/osquery/config
--config_refresh=3600
--logger_plugin=tls
--logger_tls_endpoint=/tls-logging/api/v1/osquery/log
--logger_tls_period=60
--logger_snapshot_event_type
--logger_event_type
--host_identifier=specified
--specified_identifier=TEST
--tls_dump=true
--disable_logging=false