I'm trying to figure out why osquery isn't sending...
# generalz
Zach Zeid
09/26/2019, 6:16 PMI'm trying to figure out why osquery isn't sending events to kinesis like it should be doing. Is there anyway I can kick this into debug mode or something that provides relevant logs?
p
packetzero
09/27/2019, 2:47 PMYou could write some code / scripts to query rocksdb for cached kinesis log items. That would tell you which results and status items are cached and ready to send.
packetzero
09/27/2019, 2:47 PMIf you turn on --verbose and --tls_dump you might get more.
packetzero
09/27/2019, 2:50 PMWe ended up writing a new logger that caches results and status in files, so it's easier to see the backlog and not contend for DB. It's for 3.3.1 codebase. If you want to take a crack at porting it to 4.x, let me know.
4 Views