manikant singh09/27/2020, 4:12 PM
3. After that I enabled scheduled queries and everything worked fine. I was able to query process events successfully. (after configuring required flags). Now, I am trying the same thing with docker container as a host and kolide fleet as server. I made same changes for this but changed properties as per requirement for TLS . This time able to make queries from fleet to osqueryd running inside docker container. But the only issue is with process events. It's doesn't get logged. I installed rsyslog on container but restart rsyslog doesn't work here. Finally: My doubt is is rsyslog is really required when kolide fleet is used to schedule process events queries.
template( name="OsqueryCsvFormat" type="string" string="%timestamp:::date-rfc3339,csv%,%hostname:::csv%,%syslogseverity:::csv%,%syslogfacility-text:::csv%,%syslogtag:::csv%,%msg:::csv%\n" ) *.* action(type="ompipe" Pipe="/var/osquery/syslog_pipe" template="OsqueryCsvFormat")