Title
#general
j

Jamie Windley

05/14/2019, 7:49 PM
Is there any parameter i'm missing to control max size of the results.log? Or some sort of log rotation (Mac OS)
7:50 PM
And, what user the log is created as or what permissions
zwass

zwass

05/14/2019, 7:50 PM
It's up to you as an admin to handle log shipping/rotation.
j

Jamie Windley

05/14/2019, 7:50 PM
Ok, thank you
zwass

zwass

05/14/2019, 7:52 PM
I believe the logfile will be created as the user that is running osquery, with read/write permissions for that user.
j

Jamie Windley

05/15/2019, 2:56 PM
zwass - do you know of any config setting to at least set the group of the file that is created
2:57 PM
I have to run osqueryd as a service, reading from hardware_events, thus I think it has to be run as root
2:57 PM
But I need non-root user to read the resulting log file