slevchenko
12/06/2021, 1:52 PMsyslog
and syslog_events
tables are empty.
1. I believe both events are syslog are enabled on my side, since I'm able to see syslog messages in /var/osquery/syslog_pipe
pipe.
SELECT name, value FROM osquery_flags WHERE name LIKE '%syslog%';
+---------------------------+--------------------------+
| name | value |
+---------------------------+--------------------------+
| enable_syslog | true |
| logger_syslog_facility | 19 |
| logger_syslog_prepend_cee | false |
| syslog_events_expiry | 2592000 |
| syslog_events_max | 100000 |
| syslog_pipe_path | /var/osquery/syslog_pipe |
| syslog_rate_limit | 100 |
+---------------------------+--------------------------+
2. rsyslogd is running and actually pushing messages to a pipe /var/osquery/syslog_pipe
.
sudo cat /var/osquery/syslog_pipe
[sudo] password for test:
"2021-12-06T15:38:48.459938+02:00","test-pc","5","authpriv","sudo:"," test : TTY=pts/1 ; PWD=/home/test ; USER=root ; COMMAND=/usr/bin/cat /var/osquery/syslog_pipe"
"2021-12-06T15:38:48.461863+02:00","test-pc","6","authpriv","sudo:"," pam_unix(sudo:session): session opened for user root by (uid=0)"
3. Both osquery(1st), rsyslogd(2nd) were restarted in this same order to ensure that osquery will create pipe before rsyslog will attempt to push logsseph
12/06/2021, 1:59 PMslevchenko
12/06/2021, 2:01 PMSELECT * from syslog
it's emptyseph
12/06/2021, 2:04 PMslevchenko
12/06/2021, 2:04 PMseph
12/06/2021, 2:04 PM--connect
option on osqueryislevchenko
12/06/2021, 2:05 PMseph
12/06/2021, 2:06 PMslevchenko
12/06/2021, 2:07 PM--connect
. It actually works, osquery receives messages