Francisco Huerta
04/28/2022, 7:19 AMosqueryd.results.log
file that grows in size very quickly. Ideally, the size of the results file should be kept under control.
• I configured the --logger_rotate
and associated options to keep a maximum number of files and their respective sizes in a predictive way (e.g., 10 files of up to 250MiB each). This works well and I see the files created correctly, moving the older ones to the .zst
archives, etc.
• The actual problem is once I hit the total limits (maximum number of files and archives). As stated in the documentation, osquery drops the overflowing events. As much as this being the designed behaviour, I would expect the possibility for osquery to manage the housekeeping of the existing files, giving the choice of working as stated before -i.e., dropping any new events-, or automatically rotating the files, deleting the older ones and always logging newer events.
• Furthermore, in the documentation, it is mentioned the possibility of older files to be removed but I’m not quite getting how this can be enabled… or if I’m interpreting this correctly. The actual reference in https://osquery.readthedocs.io/en/stable/installation/cli-flags/ is under the `--logger_rotate_max_files = 25`: “_[…] If a rotation happens after hitting this max, the oldest file will be removed_.“.
So, the questions, after such long explanations, are: is rotated logs deletion delegated to external tools (as suggested, e.g.,, in here ? What are the recommended best practices in multi-OS environments (e.g., use task manager + cron)? Is there any chance this option to be incorporated into osquery e.g., as an extra flag to the baseline --logger_rotate
functionality?Gavin
04/28/2022, 11:51 AMI've set osquery to log all events from a Windows machine in the local filesystem as the only output
What events are you referring to here ?seph
04/28/2022, 12:59 PMStefano Bonicatti
04/28/2022, 1:00 PMevents_max
the log file are "separate" in the sense that they come into action when there's a query that retrieves the events and which causes the logger to write the rows as results in the files.seph
04/28/2022, 1:01 PMStefano Bonicatti
04/28/2022, 1:02 PMseph
04/28/2022, 1:02 PMFrancisco Huerta
04/28/2022, 1:28 PMseph
04/28/2022, 1:39 PMFrancisco Huerta
04/28/2022, 1:39 PMosqueryd.results.log
, losqueryd.results.log.[1..4]
and the respective .zst
files. Then, I stop seeing any new events flowing to the central collection platform.seph
04/28/2022, 1:40 PMFrancisco Huerta
04/28/2022, 1:41 PM