Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
j
Jeff Singleton
04/07/2020, 3:13 PMHello. I'm trying to collect user based events, specifically failed login attempts. My user_events table is empty and I see this when I query the table: "Table user_events is event-based but events are disabled". How do I enable events for this table?
a
alessandrogario
04/07/2020, 3:19 PM--disable_events=false --disable_audit=false --audit_allow_config=true --audit_persist=true --audit_allow_user_events=true --verbose and systemctl disable auditd
j
Jeff Singleton
04/07/2020, 3:24 PMI have all of that in my flag file. Let me verify that auditd is disabled.
Does it matter what order the flags are in?
a
alessandrogario
04/07/2020, 3:27 PMFlag order is not important
auditd will cause issues if it’s running
--verbose should show what the issue is
j
Jeff Singleton
04/07/2020, 3:28 PMIt is disabled. Adding --verbose.
a
alessandrogario
04/07/2020, 3:29 PMIt is also possible that no events are being generated for that table. You can temporarily turn process_events on (--audit_allow_process_events=true) to see if the audit publisher is working correctly
j
Jeff Singleton
04/07/2020, 3:34 PMHmm. I already had that as well. I see this error when starting osqueryd: Error registering subscriber: process_file_events: Subscriber disabled via configuration
a
alessandrogario
04/07/2020, 3:35 PMThat table is disabled by default, it’s just a warning
and can be safely ignored
j
Jeff Singleton
04/07/2020, 3:35 PMOk
Is this what I am looking for?
Starting event publisher run loop: auditeventpublisher
a
alessandrogario
04/07/2020, 3:36 PMyes!
Is there no other error printed?
is the process_events table working?
j
Jeff Singleton
04/07/2020, 3:38 PMI see this: Enabling audit rules for the process_events (execve, execveat) table
No other errors.
a
alessandrogario
04/07/2020, 3:39 PMok so it seems like the audit publisher is working correctly
can you run a “SELECT * FROM process_events” query?
I haven’t used user_events much, but seem to recall that it should always record logins to the TTY
maybe on SSH too
j
Jeff Singleton
04/07/2020, 3:41 PMTable process_events is event-based but events are disabled
a
alessandrogario
04/07/2020, 3:42 PMHas the --disable_events=false flag been passed?
j
Jeff Singleton
04/07/2020, 3:42 PMyes that is in my flag file.
a
alessandrogario
04/07/2020, 3:42 PMHas osquery been restarted?
j
Jeff Singleton
04/07/2020, 3:43 PMYes I have restarted after each change.
a
alessandrogario
04/07/2020, 3:43 PMor, it is possible that the flagfile is not being correctly loaded
you can pass the path to it using --flagfile=/path/to/file
(I think the default path is
/etc/osquery/osquery.flags.defaultj
Jeff Singleton
04/07/2020, 3:47 PMI'm running this on the command line in two windows. One has osqueryd --flagfile /etc/osquery/osquery.flag and the other is running osqueryi.
a
alessandrogario
04/07/2020, 3:47 PMosqueryi does not communicate with osqueryd
osqueryi is osqueryd running in interactive mode
j
Jeff Singleton
04/07/2020, 3:49 PMGot that.
a
alessandrogario
04/07/2020, 3:49 PMso if you run
osqueryi --flagfile /etc/osquery/osquery.flag(osqueryd must be closed otherwise it will attempt to steal the audit ownership from osqueryi)
j
Jeff Singleton
04/07/2020, 3:55 PMOh man...I think because I didn't fully understand that, I figured it out. I actually didn't have --disable-events=false and now I do and its working.
I guess it just takes going through it line by line.
a
alessandrogario
04/07/2020, 3:56 PMNice! 😄 if you have any issue we are here to help 🙂
j
Jeff Singleton
04/07/2020, 3:57 PMThank-you!!