Stephan M

10/10/2022, 3:32 PM
What's the correct way to set osquery's
via the agent options? Started to get
Could not update settings. common config: json: unknown field "config_refresh"
with the latest version even though it's a valid option based on https://osquery.readthedocs.io/en/stable/installation/cli-flags/#configuration-control-flags

Juan Alvarez

10/10/2022, 3:54 PM
i think that config_refresh is a CLI flag, and therefore cannot be set via options. While this was not enforced in the past, it is since 5.4: https://github.com/osquery/osquery/pull/7561
3:55 PM
you can check what flags can be changed via config if you do
osqueryd --help
Kathy Satterlee

Kathy Satterlee

10/10/2022, 3:59 PM
Thanks, @Juan Alvarez! This was possible to set through agent options previously, but the general rule of thumb is that you can set osquery options, but not command-line flags, through Fleet's agent options.

Stephan M

10/10/2022, 4:00 PM
Good to know, thank you