manikant singh
09/27/2020, 4:12 PMtemplate(
name="OsqueryCsvFormat"
type="string"
string="%timestamp:::date-rfc3339,csv%,%hostname:::csv%,%syslogseverity:::csv%,%syslogfacility-text:::csv%,%syslogtag:::csv%,%msg:::csv%\n"
)
*.* action(type="ompipe" Pipe="/var/osquery/syslog_pipe" template="OsqueryCsvFormat")
3. After that I enabled scheduled queries and everything worked fine. I was able to query process events successfully. (after configuring required flags).
Now, I am trying the same thing with docker container as a host and kolide fleet as server.
I made same changes for this but changed properties as per requirement for TLS .
This time able to make queries from fleet to osqueryd running inside docker container.
But the only issue is with process events. It's doesn't get logged.
I installed rsyslog on container but restart rsyslog doesn't work here.
Finally: My doubt is is rsyslog is really required when kolide fleet is used to schedule process events queries.theopolis
09/28/2020, 3:11 PM