Jerome
11/13/2019, 9:04 AMosquery.conf
seems ignored. I'm on Linux and I used the default conf file from /usr/share/osquery/osquery.example.conf
and I just set up the parameter "disable_tables": "chrome_extensions",
but when I start osqueryi
or osqueryd
the table is still available. Same if I explicitely provide the conf file osqueryi --config_path=/etc/osquery/osquery.conf
I don't understand what I do wrong--disable_tables=chrome_extensions
sharvil
11/13/2019, 9:42 AMdisable_tables
flag, but just not query-ableJerome
11/13/2019, 9:54 AMError: no such table: chrome_extensions
when I use the flag but not when I use the config filesharvil
11/13/2019, 10:09 AMJerome
11/13/2019, 10:14 AMseph
Jerome
11/13/2019, 1:24 PMseph
dover:~ seph$ cat /tmp/c.conf
{ "options": { "disable_tables": "chrome_extensions" } }
dover:~ seph$ /usr/local/kolide-k2/bin/osqueryd -S --config_path /tmp/c.conf
Using a virtual database. Need help, type '.help'
osquery> select version from osquery_info;
+---------+
| version |
+---------+
| 4.0.2 |
+---------+
osquery> select * from chrome_extensions;
Error: no such table: chrome_extensions
(It fails if I use process substitution)Jerome
11/13/2019, 2:01 PMdecorators
the config file is ignoredseph
Jerome
11/13/2019, 2:18 PMseph