Hello has osquery changed how osqueryd results log works It

Question

Hello has osquery changed how osqueryd results log works It now uses a sticky bit and I can t find any documentation to what changed I am struggling to change these permissions as the daemon keeps changing it back which means I can t log my results into splunk Thanks

seph · Answer

I don t think we merged something that would change this Is this an issue with the enclosing directory Does the sticky but cover files

seph · Answer

Though <https github com osquery osquery pull 7015|https github com osquery osquery pull 7015> did change some of logging

seph · Answer

Are you using the logger mode flag

JohnM · Answer

Hello Seph Within my osquery conf file I have logger mode 644

JohnM · Answer

I am running all my conf within the osquery conf file and it looks like the daemon is using an osquery flags file Could that be an issue

Stefano Bonicatti · Answer

Beware that gflags doesn t parse octal and normally you would have to write it as `0644` Though for instance the documentation makes an example with ` logger mode=420` because that s the decimal value of the octal `0644`

Stefano Bonicatti · Answer

So you need to use ` logger mode=420` while the default right now is ` logger mode=416`

Stefano Bonicatti · Answer

Also the documentation has to be corrected

seph · Answer

I think we should fix the parsing not the documentation But we can chat in the PR

JohnM · Answer

They documentation does state File mode for output log files by the filesystem plugin provided as an octal string I must have missed that out thanks for the help

Stefano Bonicatti · Answer

ah yeah but still the `octal string` part is incorrect because if so it would accept `0644` or `644` and always parse it as an octal it s instead parsing it in base 10 so as a decimal

JohnM · Answer

Ah yes it is a pain working out the decimal I have used 420 which is rw r r and I seem to be logging it correctly Thanks all Glad I could help towards a fix too slightly smiling face