Jason Lockwood
03/16/2021, 6:14 PMMike Myers
03/16/2021, 8:27 PM--verbose
and share the output here, including the path of the conf file and the permissions on it. If it's osqueryi
, it can work without the conf file too.Jason Lockwood
03/16/2021, 11:53 PMMike Myers
03/17/2021, 6:55 PMJason Lockwood
03/18/2021, 6:01 PMMike Myers
03/18/2021, 9:26 PMJason Lockwood
04/20/2021, 4:13 PM--disable_events=false
--enable_windows_events_publisher=true
--enable_windows_events_subscriber=true
--enable_ntfs_event_publisher=true
--verbose
Mike Myers
04/20/2021, 6:48 PMJason Lockwood
04/20/2021, 10:25 PM