Philip Royer
09/26/2022, 3:30 PM--logger_plugin=windows_event_log
. I am curious if perhaps the issue is that the command line flag from here: https://github.com/fleetdm/fleet/blob/ecd155c16faebb033b3ea52e4cab309b54947220/orbit/pkg/osquery/flags.go is overriding the line in the flagfile. If so, is there a way to configure Orbit to not pass that logger plugin command line argument?sharvil
09/26/2022, 3:42 PMselect name, value from osquery_flags where name = 'logger_plugin';
Philip Royer
09/26/2022, 3:59 PMlogger_plugin=windows_event_log
, but I don't quite understand how it got there because I thought the CLI argument from Orbit would override the flagfile. But if that is correct then maybe registering the event log channel is the only issue. When trying to do that I am not seeing where the windows event log manifest file gets dropped on the endpoint when the .msi orbit package is installed. I also thought stuff like that would be taken care of by Orbit.C:\Program Files\osquery
instead of in the Orbit directory.sharvil
09/26/2022, 4:12 PMPhilip Royer
09/26/2022, 4:14 PMsharvil
09/26/2022, 4:14 PM