Dongho Kim
01/03/2020, 6:37 AMW0103 15:36:34.866801 22423 filesystem.cpp:112] Cannot read file that exceeds size limit: /snap/slack/20/usr/lib/slack/slack
W0103 15:36:34.895962 22423 filesystem.cpp:112] Cannot read file that exceeds size limit: /opt/google/chrome/chrome
W0103 15:36:35.829485 22423 filesystem.cpp:112] Cannot read file that exceeds size limit: /snap/spotify/36/usr/share/spotify/spotify
alessandrogario
01/03/2020, 1:31 PMthor
01/03/2020, 4:20 PMalessandrogario
01/03/2020, 4:23 PMDongho Kim
01/10/2020, 12:37 AMthor
01/10/2020, 12:38 AMosqueryd.exe --flagfile=/Path/to/osquery.flags
, and one tends to put most of their configuration flags inside that file.Dongho Kim
01/10/2020, 12:49 AMosqueryd flagfile=/etc/osquery/osquery.flags
however it produces following error
E0110 09:47:36.233642 20142 init.cpp:459] osqueryd initialize failed: Could not create file: /var/run/osqueryd.pidfile
so I ran with sudo but still gave following returnW0110 09:47:44.866137 20153 init.cpp:690] Error reading config: config file does not exist: /etc/osquery/osquery.conf
I0110 09:47:44.866581 20153 events.cpp:863] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration
I0110 09:47:44.866720 20153 events.cpp:863] Event publisher not enabled: syslog: Publisher disabled via configuration
thor
01/10/2020, 12:50 AM--
in the flagfile, as osquery might be failing to find your pathW0110 09:47:44.866137 20153 init.cpp:690] Error reading config: config file does not exist: /etc/osquery/osquery.conf
Dongho Kim
01/10/2020, 12:52 AMthor
01/10/2020, 12:53 AMDongho Kim
01/10/2020, 1:08 AMthor
01/10/2020, 5:18 PM--disable_events=false
. That should also be pretty exhaustively documented on the readthedocs if you need additional support