Title
#general
p

Prakhar

04/16/2018, 6:56 AM
Hi, is there any option for log rotation for osquery's result logs ? If yes, please share the doc link. Thanks
y

yuvalapidot

04/16/2018, 7:17 AM
As far as I know osquery doesn't support rotation out of the box. I would recommend using logrotate on linux.
p

Prakhar

04/16/2018, 10:34 AM
Ok thanks. Just one doubt, does osquery open and closes the file decriptor everytime it writes to log file or does it keep the fd open ?
y

yuvalapidot

04/16/2018, 3:05 PM
I don't know, but I guess it doesn't. I ran into a problem when I used logrotate on kolide logs, and the fd was kept open, thus no new file was created. Logrotate allow you to use copy truncate flag, which will solve this issue. Yet I am not sure this is the same with osquery
zwass

zwass

04/16/2018, 4:20 PM
Kolide fleet works with the standard logrotation scheme of sending a
SIGHUP
to move to a new log file. Standard osquery doesn't not have any log rotation support afaik.
p

Prakhar

04/17/2018, 6:56 AM
ok thanks