hi everyone i m struggling with flag files How do I script a

Question

hi everyone i m struggling with flag files How do I script a solution to this problem The CLI only flag config plugin set via config file will be ignored please use a flagfile or pass it to the process at startup The CLI only flag logger plugin set via config file will be ignored please use a flagfile or pass it to the process at startup

Stefano Bonicatti · Answer

Hello < Mario Bardowell> you might want to check

Stefano Bonicatti · Answer

``` options config plugin filesystem logger plugin filesystem utc true ``` ^ those should not be passed through the config file

Stefano Bonicatti · Answer

those are the ones that osquery is complaining about

Mario Bardowell · Answer

So I need to remove them and place them in a seperate file

Stefano Bonicatti · Answer

yes

Stefano Bonicatti · Answer

You can see an example in the provided link

Mario Bardowell · Answer

so I should do something like this

Mario Bardowell · Answer

echo Creating flagfile sleep 6 cd var osquery echo $ config plugin=true n logger plugin=true gt var osquery osquery flags

Stefano Bonicatti · Answer

yeah

Mario Bardowell · Answer

I can leave this option in the config options utc true

Mario Bardowell · Answer

and do I need to just need to osqueryctl start without loading the plist

Stefano Bonicatti · Answer

The utc flag doesn t exist anymore You might want to run osquery with ` help` and check the current flags It also separates them in the various categories of flags command line flags or CLI only flags configuration options and shell only flags