https://github.com/osquery/osquery logo
Title
s

slevchenko

09/27/2022, 11:38 AM
Hi everyone. I'm trying to use logger plugin: https://github.com/osquery/osquery-go/blob/master/examples/logger/main.go but ran into some issues. As I understand logger_plugin expects flags to be passed, but is not passing them:
flag provided but not defined: -verbose
osqueryd[99410]: Usage of /opt/osquery/plugins/logger/threat_logger.ext:
osqueryd[99410]:   -interval int
osqueryd[99410]:   -socket string
osqueryd[99410]:             path to osqueryd extensions socket
osqueryd[99410]:   -timeout int
What I've did: 1. Loaded logger_plugin via
extensions.load
file
/opt/osquery/plugins/logger/threat_logger.ext
2. Enabled it via logger_plugin flag:
--logger_plugin=/opt/osquery/plugins/logger/threat_logger.ext
s

seph

09/27/2022, 1:54 PM
Those examples are super old. It’s entirely likely that osquery now expects extensions to accept
-verbose
and those need to be updated.
You could add a flag for it, it can do nothing. And see if it solves the issue
s

slevchenko

09/27/2022, 1:55 PM
exactly
I've removed verbose and example started to work
wanted to report that to @zwass... but as I understood, it's already known thing
s

seph

09/27/2022, 1:57 PM
Removed it from where?
s

slevchenko

09/27/2022, 1:57 PM
@seph One more thing. Can I use two loggers in a same time ? Filesystem and custom
s

seph

09/27/2022, 1:58 PM
I can’t remember. Probably? Try it 🙂
s

slevchenko

09/27/2022, 1:58 PM
from
osquery.flags
file
s

seph

09/27/2022, 1:58 PM
Ah, so if osquery has
verbose
set, then it passes it to the extensions and those examples lack it? I’d suggest filing an issue in osquery-go, or just sending in a PR. Assuming it’s reasonable, I’d approve it
s

slevchenko

09/27/2022, 1:59 PM
I'm asking because I've just made up
filesystem
logger plugin, I don't know how it's called in reality, or if it even exists as an option
s

seph

09/27/2022, 2:00 PM
I’m not sure I understand your question
s

slevchenko

09/27/2022, 2:01 PM
I need something like:
"logger_plugin": "threat_logger,filesystem"
so first logger would be my plugin
and second or rather secondary would be afile on a filesystem
do you know if this is possible or not ?
s

seph

09/27/2022, 2:02 PM
Right. I can’t remember if it works. Probably, test it.
s

slevchenko

09/27/2022, 2:02 PM
ok thanks
z

zwass

09/27/2022, 3:06 PM
You can definitely use multiple logger plugins. I think one or more of them could be from an extension.
s

slevchenko

09/27/2022, 3:08 PM
Yes, but I can't find how standard one is called
is sit
filesystem
or
default
or something else
s

seph

09/27/2022, 3:10 PM
https://osquery.readthedocs.io/en/latest/deployment/logging/#logger-plugins says
filesystem
and confirms you can have multipole
s

slevchenko

09/27/2022, 3:15 PM
thanks folks
I'll use that