I am enabling osquery on a linux system, and Iooking for logs on mount and umount of file systems. I see those logs on /var/log/messages file but when I check syslog_events table I dont get these logs.
Did anyone face a similar issue?
06/15/2021, 12:58 PM
If you’re trying to process syslog events, you must also configure syslog to send messages to osquery. I believe this is in the syslog documentation. Did you configure that?
06/15/2021, 1:44 PM
yes, I see other logs. But not the mount logs I am looking for.
I see this line in /var/log/messages:
Jun 15 134154 uk-9742-000732763282 systemd: Unmounting /var/lib/docker/image/overlay2...
And when I do:
select * from syslog_events where tag like 'systemd%' and message like '%mount%';
result is empty
There is another line like this:
Jun 15 144036 uk-9742-000732763282 systemd: Started Sync program to install, update and maintain apps on till.
and when I do:
select * from syslog_events where tag like 'systemd%';
There is data
06/15/2021, 3:25 PM
events tables are a bit weird. They may not gather events prior to the queries running. Is this osqueryi or osqueryd?
What happens if you issue the query, get no logs in osquery, then trigger your mount events?
06/16/2021, 6:21 AM
I was using osqueryi and deliberately did a mount while I have it running.
even then I did not see the event being captured in the table.