Is there a best practice for running osqueryd in the background all the time on linux and windows? In the case of wanting to always be able to live query from Fleet? Or am I thinking about this incorrectly?
08/26/2021, 2:19 AM
Under windows, you’d run it as a service.
For linux, it depends on the linux flavor. But usually under systemd.
The osquery packages are configured to do those things.