I'm trying to troubleshoot where or not osquery is sending info to a kinesis stream, but there doesn't appear to be anything in

/var/log/osquery

. Running the

osqueryd

command with

--ephemeral

doesn't clearly say there is anything wrong, but it seems to chock on loading extensions and creating a socket. Is that expected behavior?

That can be expected if the extensions autoload file doesn't exist and/or the process doesn't have permissions to create the socket.

So that means that an extensions file needs to exist somewhere? I don't see a reference inthe docs

It doesn't need to, you'll just get an error about autoloading extensions if it doesn't.

Ok, thank you that answers my question.