Title
#general
m

Mario Bardowell

10/17/2022, 5:41 PM
hi everyone, i'm struggling with flag files. How do I script a solution to this problem? - The CLI only flag --config_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup The CLI only flag --logger_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
Stefano Bonicatti

Stefano Bonicatti

10/17/2022, 5:42 PM
5:44 PM
"options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "utc": "true"
},
^ those should not be passed through the config file
5:44 PM
those are the ones that osquery is complaining about
m

Mario Bardowell

10/17/2022, 5:45 PM
So I need to remove them and place them in a seperate file?
Stefano Bonicatti

Stefano Bonicatti

10/17/2022, 5:46 PM
yes
5:47 PM
You can see an example in the provided link
m

Mario Bardowell

10/17/2022, 5:47 PM
so I should do something like this...
5:47 PM
#echo "Creating flagfile" #sleep 6 #cd /var/osquery #echo $'--config_plugin=true\n--logger_plugin=true' > /var/osquery/osquery.flags
Stefano Bonicatti

Stefano Bonicatti

10/17/2022, 5:49 PM
yeah
m

Mario Bardowell

10/17/2022, 5:50 PM
I can leave this option in the config "options": { "utc": "true" },
5:51 PM
and do I need to just need to osqueryctl start without loading the plist?
Stefano Bonicatti

Stefano Bonicatti

10/17/2022, 5:53 PM
The utc flag doesn’t exist anymore. You might want to run osquery with
--help
and check the current flags. It also separates them in the various categories of flags (command line flags or CLI only flags, configuration options and shell only flags)