Ojas
10/06/2022, 5:30 AMJuan Fernandez
10/06/2022, 11:03 AM--carver_continue_endpoint
flag? That flag is meant to be set in the flagfile for connecting osquery agents to Fleet.Ojas
10/06/2022, 11:06 AMJuan Fernandez
10/06/2022, 12:01 PM--carver_continue_endpoint
setting is being set in the wrong place https://fleetdm.com/docs/using-fleet/fleetctl-cli#configurationOjas
10/06/2022, 12:09 PMJuan Fernandez
10/06/2022, 12:10 PM/api/v1/osquery/carve/block
but via the flagfileOjas
10/06/2022, 12:11 PMJuan Fernandez
10/06/2022, 12:13 PMOjas
10/06/2022, 7:42 PMJuan Fernandez
10/06/2022, 7:54 PMSettings
-> Agent options
?Ojas
10/07/2022, 5:11 AMJuan Fernandez
10/07/2022, 11:17 AM--carver_start_endpoint
and --carver_continue_endpoint
flags are meant to be set via either the flagfile or as inline options when launching osquery - you will need to remove those two options from your global config. By default, the installer generated via the 'Add New Host' dialog include the following options (see here for more details):
--disable_carver=false
--carver_disable_function=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2097152
So if you just remove those two options you should be all set.Ojas
10/07/2022, 11:38 AM