Title
#general
w

wennan.he

10/13/2022, 5:40 PM
Hi osquery team, i enabled some flags through flag file
--disable_events=false
, --enable_file_events=true, --disable_audit=false and --enable_ntfs_event_publisher=true, then i restart osquery but when i login osqueryi and check osquery_flags, i can see the value of them not changed. plz advice.
Stefano Bonicatti

Stefano Bonicatti

10/13/2022, 5:42 PM
osqueryi
is not, by default, a client to the daemon; the
osqueryi
binary is a link (or a copy on Windows) to the daemon, it’s the same binary that starts as a shell instead of a daemon
w

wennan.he

10/13/2022, 5:43 PM
so how could i check the vals of flags of running osquery agent?
Stefano Bonicatti

Stefano Bonicatti

10/13/2022, 5:44 PM
You can try to connect to the daemon via the extension socket, provided that’s not disabled. Launching the
osqueryi
shell you can use the
.connect PATH
command, with PATH the path to the extensions socket.
5:45 PM
then the queries you do from there will run on the daemon.
5:46 PM
Keep in mind that this is mostly a debug feature
w

wennan.he

10/13/2022, 5:46 PM
like osqueryi .connect PATH?
5:47 PM
sorry what should i fill for PATH? what does it mean by extensions socket?
Stefano Bonicatti

Stefano Bonicatti

10/13/2022, 5:47 PM
You first execute osqueryi to get to the shell, then use that command
w

wennan.he

10/13/2022, 5:48 PM
ok
Stefano Bonicatti

Stefano Bonicatti

10/13/2022, 5:52 PM
osquery supports being extended, by adding new tables via extensions, that are separate processes that communicate back to osquery via a thrift socket. Depending on the system it’s either a unix domain socket or a named pipe on Windows. This is used to have the shell connect to the daemon and run queries. As to where to find it, depends if it’s the default or if it has changed. By default on Windows should be
\\.\pipe\osquery.em
w

wennan.he

10/13/2022, 6:18 PM
@Stefano Bonicatti i suffered this err when i connect PATH. []osquery> select * from osquery_flags where name="disable_events"; Error: Extension call failed: connect() failed: No such file or directory []osquery> select * from osquery_flags [*] ...> ; Error: Extension call failed: connect() failed: No such file or directory
Keith Swagler

Keith Swagler

10/14/2022, 2:12 PM
can you try changing "linux" to platform value from os_version ? "rhel" or "debian" will probably be right but I can't confirm