https://github.com/osquery/osquery logo
#general
Title
# general
s

sean.cavanaugh

08/06/2020, 6:36 PM
What would the ramifications of using the
--disable_database
flag be? Would blacklisted queries no longer be recorded/enforced?
s

seph

08/06/2020, 6:48 PM
From
--help
Disable the persistent RocksDB storage
This would disable event based tables. I’m not sure how it would effect blacklisted queries.
Use case is mostly for quick testing and examples. If you’re doing simple testing, you can skip creating the local storage
17 Views