Hi 👋 I’m been trying to setup osquery (v4.0.2) via kolide fleet, and it seems that although the configuration is updated (when I query I can see they were changed, and I also have a differential on

osquery_flags

which is triggered), osquery itself does not refresh them during runtime, I have to manually restart the daemon. The flag in question is the

logger_plugin

one, I’m not sure if this is intended, or if I’m missing something here. I tried searching around and found this thread, which is somewhat related, but

logger_plugin

is already defined as

FLAG

and not

CLI_FLAG

https://osquery.slack.com/archives/C08V7KTJB/p1572289712208900?thread_ts=1572289712.208900

That you'd need to restart osquery to see flag file changes seems unsurprising.

@João Godinho, to clarify, in your testing you see

logger_plugin

is set to the new value (when you look at

osquery_flags

) but osquery is not logging to the new plugin?

Hi (sorry, timezones), basically I have a default flags file with

logger_plugin=tls

, when the host registers with fleet, I send different configurations for the logger (

kafka_producer

), which does not takes effect until the daemon is restarted, and when yeah, the

osquery_flags

shows the new value.