Thomas Stromberg
10/20/2022, 4:06 PMsocket_events
and process_events
tables are populated on half of our Linux machines running Kolide, but not the other. It sort of follows Linux distribution boundaries:
• Ubuntu: Yes!
• Fedora: No
• Arch: Mixed
• NixOS: Mixed. One machine has data in process_events
, the other doesn't. Both seem to only record systemd-timesyncd
bind calls in socket_events
One of the ones where none of the tables are populated is my personal machine, so I'm happy to investigate. Is it possible that the auditd rules installed by osquery could conflict with previously written configurations? I did check the output of sudo journalctl -t launcher
but it didn't seem to give any indications.seph
10/20/2022, 4:32 PM