hi everyone, i'm struggling with flag files. How d...
# generalm
Mario Bardowell
10/17/2022, 5:41 PMhi everyone, i'm struggling with flag files. How do I script a solution to this problem? - The CLI only flag --config_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
The CLI only flag --logger_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
s
Stefano Bonicatti
10/17/2022, 5:42 PMHello @Mario Bardowell, you might want to check https://osquery.readthedocs.io/en/latest/installation/cli-flags/#flagfile
Stefano Bonicatti
10/17/2022, 5:44 PM Copy code
"options": {
"config_plugin": "filesystem",
"logger_plugin": "filesystem",
"utc": "true"
},Stefano Bonicatti
10/17/2022, 5:44 PMthose are the ones that osquery is complaining about
m
Mario Bardowell
10/17/2022, 5:45 PMSo I need to remove them and place them in a seperate file?
s
Stefano Bonicatti
10/17/2022, 5:46 PMyes
Stefano Bonicatti
10/17/2022, 5:47 PMYou can see an example in the provided link
m
Mario Bardowell
10/17/2022, 5:47 PMso I should do something like this...
Mario Bardowell
10/17/2022, 5:47 PM#echo "Creating flagfile"
#sleep 6
#cd /var/osquery
#echo $'--config_plugin=true\n--logger_plugin=true' > /var/osquery/osquery.flags
s
Stefano Bonicatti
10/17/2022, 5:49 PMyeah
m
Mario Bardowell
10/17/2022, 5:50 PMI can leave this option in the config "options": {
"utc": "true"
},
Mario Bardowell
10/17/2022, 5:51 PMand do I need to just need to osqueryctl start without loading the plist?
s
Stefano Bonicatti
10/17/2022, 5:53 PMThe utc flag doesn’t exist anymore. You might want to run osquery with
--help6 Views