Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
h
HarlanF
08/14/2021, 12:42 AMCan anyone point me to where the ERROR WARNING and INFO symlinks are created in the source code? Trying to figure out what logic's used.
z
zwass
08/14/2021, 12:44 AMHaven't looked at this in a while, but it might be done in
glogs
Stefano Bonicatti
08/14/2021, 9:02 AMWhere to log is somewhat decided by glog yes, but we also provide destinations for specific log levels here https://github.com/osquery/osquery/blob/08736648aacaefbdfc90bc2b87acc4414fd6c9ec/plugins/logger/filesystem_logger.cpp#L249-L252
Though how I see it currently working is that .INFO contains everything from INFO and up (controlled by the logger_min_status flag), .WARNING contains from the warnings and up (so also errors) and .ERROR contains errors only.
:ty: 1
(This is akin to syslog)
h
HarlanF
08/16/2021, 2:57 PMYou rock, guys; thanks so much!
That's peculiar that those strata have their own value and up, if one had three different specific files.