João Godinho
12/13/2019, 12:07 AMosquery_flags
which is triggered), osquery itself does not refresh them during runtime, I have to manually restart the daemon.
The flag in question is the logger_plugin
one, I’m not sure if this is intended, or if I’m missing something here. I tried searching around and found this thread, which is somewhat related, but logger_plugin
is already defined as FLAG
and not CLI_FLAG
https://osquery.slack.com/archives/C08V7KTJB/p1572289712208900?thread_ts=1572289712.208900seph
12/13/2019, 1:46 AMtheopolis
12/13/2019, 2:22 AMlogger_plugin
is set to the new value (when you look at osquery_flags
) but osquery is not logging to the new plugin?João Godinho
12/13/2019, 9:49 AMlogger_plugin=tls
, when the host registers with fleet, I send different configurations for the logger (kafka_producer
), which does not takes effect until the daemon is restarted, and when yeah, the osquery_flags
shows the new value.logger_kafka_brokers
and topic
doesn’t seem to work either, but changing verbose
, for example, works