Helio Martins
03/16/2020, 4:01 AMosquery
configuration?
I'm struggling to get some of the osquery.flags
the configuration set into my osquery.db
..
Performing a simple select * from osquery_flags;
doesn't return any of the flags set in my osquery.flags
.
Realy appreciate your help.seph
configuration set into my osquery.dbThis doesn’t really sound correct.
osquery.db
is a bunch of mostly ephemeral state. It’s not something you get things into. You’re trying to pass flags along to a running osqueryd
. (or “osquery daemon”)Helio Martins
03/16/2020, 9:50 PMassert
based in some values returned from select * from osquery_flags
...sudo osqueryctl start
sudo osqueryctl status
● osqueryd.service - The osquery Daemon
Loaded: loaded (/usr/lib/systemd/system/osqueryd.service; disabled; vendor preset: enabled)
Active: active (running) since Mon 2020-03-16 21:54:08 UTC; 5s ago
Process: 15029 ExecStartPre=/bin/sh -c if [ -f $LOCAL_PIDFILE ]; then mv $LOCAL_PIDFILE $PIDFILE; fi (code=exited, status=0/SUCCESS)
Process: 15028 ExecStartPre=/bin/sh -c if [ ! -f $FLAG_FILE ]; then touch $FLAG_FILE; fi (code=exited, status=0/SUCCESS)
Main PID: 15030 (osqueryd)
Tasks: 17 (limit: 4915)
CGroup: /system.slice/osqueryd.service
├─15030 /usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --config_path /etc/osquery/osquery.conf
└─15032 /usr/bin/osqueryd
seph
Helio Martins
03/16/2020, 10:34 PMseph
Helio Martins
03/16/2020, 10:47 PMosqueryi SELECT name || \' \' || value FROM osquery_flags;" --list
its(:stdout) { should include 'host_identifier hostname' }
seph
osqueryctl
earlier, osqueryi
is mostly unrelated.Helio Martins
03/16/2020, 11:03 PMseph
Helio Martins
03/16/2020, 11:07 PMseph
select * from processes
and osquery does something akin to ps | sql-transform
osquery.db
in the middle is misleading.Helio Martins
03/16/2020, 11:28 PM