https://github.com/osquery/osquery logo
#general
Title
# general
m

Mario Bardowell

10/17/2022, 5:41 PM
hi everyone, i'm struggling with flag files. How do I script a solution to this problem? - The CLI only flag --config_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup The CLI only flag --logger_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
s

Stefano Bonicatti

10/17/2022, 5:42 PM
Copy code
"options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "utc": "true"
},
^ those should not be passed through the config file
those are the ones that osquery is complaining about
m

Mario Bardowell

10/17/2022, 5:45 PM
So I need to remove them and place them in a seperate file?
s

Stefano Bonicatti

10/17/2022, 5:46 PM
yes
You can see an example in the provided link
m

Mario Bardowell

10/17/2022, 5:47 PM
so I should do something like this...
#echo "Creating flagfile" #sleep 6 #cd /var/osquery #echo $'--config_plugin=true\n--logger_plugin=true' > /var/osquery/osquery.flags
s

Stefano Bonicatti

10/17/2022, 5:49 PM
yeah
m

Mario Bardowell

10/17/2022, 5:50 PM
I can leave this option in the config "options": { "utc": "true" },
and do I need to just need to osqueryctl start without loading the plist?
s

Stefano Bonicatti

10/17/2022, 5:53 PM
The utc flag doesn’t exist anymore. You might want to run osquery with
--help
and check the current flags. It also separates them in the various categories of flags (command line flags or CLI only flags, configuration options and shell only flags)
5 Views