Tyler Fisher
01/02/2020, 9:51 PMprocess_events
table - does anyone know where the documentation is?
root@ubuntu:/etc/osquery# cat osquery.flags
--audit_allow_config=true
--audit_allow_sockets
--audit_persist=true
--audit_allow_process_events=true
--disable_audit=false
--events_expiry=1
--events_max=500000
--logger_min_status=1
--logger_plugin=filesystem
--watchdog_memory_limit=350
--watchdog_utilization_limit=130
$ sudo osqueryi --flagfile /etc/osquery/osquery.flags
Using a virtual database. Need help, type '.help'
osquery> select * from process_events;
W0102 16:44:29.887578 30811 virtual_table.cpp:930] Table process_events is event-based but events are disabled
W0102 16:44:29.887630 30811 virtual_table.cpp:937] Please see the table documentation: <https://osquery.io/schema/#process_events>
I don't have auditd enabled, and osquery is running as root.João Godinho
01/02/2020, 9:51 PM--audit_allow_process_events=true
?Tyler Fisher
01/02/2020, 9:52 PMJoão Godinho
01/02/2020, 9:52 PMselect * from osquery_flags;
to seeTyler Fisher
01/02/2020, 9:55 PMosquery> select name, value from osquery_flags where name LIKE '%audit%process%';
+---------------------------------+-------+
| name | value |
+---------------------------------+-------+
| audit_allow_fork_process_events | false |
| audit_allow_process_events | true |
+---------------------------------+-------+
osquery> select * from process_events;
W0102 16:54:41.409562 31005 virtual_table.cpp:930] Table process_events is event-based but events are disabled
W0102 16:54:41.409584 31005 virtual_table.cpp:937] Please see the table documentation: <https://osquery.io/schema/#process_events>
João Godinho
01/02/2020, 9:57 PMselect * from osquery_events;
trigger some event on another shell, and checking this table again? if the number of events changes?theopolis
%audit%
and %event%
flags tweak the type of events and performance option, they are relevant but those three above are the most importantTyler Fisher
01/02/2020, 10:01 PMdisable_events
flag - I'll change that from true
to false
.João Godinho
01/02/2020, 10:02 PMTyler Fisher
01/02/2020, 10:02 PMseph
Tyler Fisher
01/02/2020, 10:03 PMdisable_events
to false
- wasn't aware that the flag existed, thanks for your help everyone!theopolis
select * from osquery_events;
João Godinho
01/02/2020, 10:05 PMtheopolis
active
column that tells you if the publisher (the internal thing that is sending events to tables) and subscribers (the tables themselves) are workingTyler Fisher
01/02/2020, 10:06 PMosquery> select name, publisher, subscriptions, events, active from osquery_events where name like '%process_%events%';
+---------------------+---------------------+---------------+--------+--------+
| name | publisher | subscriptions | events | active |
+---------------------+---------------------+---------------+--------+--------+
| process_events | auditeventpublisher | 1 | 14 | 1 |
| process_file_events | auditeventpublisher | 0 | 0 | 0 |
+---------------------+---------------------+---------------+--------+--------+
active
is set to 1 for the process_events
publisher. 👌yossarian
01/02/2020, 10:18 PMseph
disable_audit
Tyler Fisher
01/02/2020, 10:20 PMseph
Tyler Fisher
01/02/2020, 10:21 PM