https://github.com/osquery/osquery logo
Title
e

Erich Stoekl

03/16/2020, 6:00 PM
Hi Folks. I'm wondering if
--disable_events=false
needs to be used with
--disable_audit=false
z

zwass

03/16/2020, 6:04 PM
No it does not.
e

Erich Stoekl

03/16/2020, 6:05 PM
If I don't use
disable_events=false
, how would I pick up on the process_events data?
would I just not have the
process_events
table in that case (if i'm monitoring process events)?
z

zwass

03/16/2020, 6:11 PM
Ah sorry I interpreted your question backwards. Yes, you need to enable events in order to get any event-based tables.
e

Erich Stoekl

03/16/2020, 6:17 PM
no worries. Thanks!!