Philip Royer09/26/2022, 3:30 PM
. I am curious if perhaps the issue is that the command line flag from here: https://github.com/fleetdm/fleet/blob/ecd155c16faebb033b3ea52e4cab309b54947220/orbit/pkg/osquery/flags.go is overriding the line in the flagfile. If so, is there a way to configure Orbit to not pass that logger plugin command line argument?
sharvil09/26/2022, 3:42 PM
select name, value from osquery_flags where name = 'logger_plugin';
Philip Royer09/26/2022, 3:59 PM
, but I don't quite understand how it got there because I thought the CLI argument from Orbit would override the flagfile. But if that is correct then maybe registering the event log channel is the only issue. When trying to do that I am not seeing where the windows event log manifest file gets dropped on the endpoint when the .msi orbit package is installed. I also thought stuff like that would be taken care of by Orbit.
instead of in the Orbit directory.
sharvil09/26/2022, 4:12 PM
Philip Royer09/26/2022, 4:14 PM
sharvil09/26/2022, 4:14 PM