https://github.com/osquery/osquery logo
Title
a

Anadi

12/20/2018, 11:59 AM
There is more than that. You will not be able to view the event tables, and may not be able to run queries on a schedule.
z

zwass

12/20/2018, 7:01 PM
This is not correct. You can get results from event-based tables, but the event producers are disabled by default. If you want to test events with osqueryi, you need to use
osqueryi --disable_events=false
. Note that if both osqueryi and osqueryd are running with events turned on you may find weird behaviors.
👍 1
a

Anadi

12/21/2018, 2:50 AM
Thanks, I stand corrected.