https://github.com/osquery/osquery logo
Title
c

Chris Broome

07/03/2019, 3:09 PM
not sure if this is a core question or a fleet question, but here goes: I noticed in the fleet source recently that the
OsqueryLogger
struct has separate
Status
and
Result
loggers. that’s great! However, in the osquery source code I don’t a distinction made between the 2 types of logs. My question is this: is it possible to configure osquery to send status logs to a different output than the result logs?
z

zwass

07/03/2019, 5:03 PM
It is not possible to configure osquery to send status and result logs to different logger plugins, however it is common for the logger plugin (or consumer of the logs) to split them into separate streams. For example, the filesystem logger logs results and statuses to different files. Fleet receives all the logs over the tls logger plugin, but splits the results and statuses into separate streams for output.
c

Chris Broome

07/03/2019, 5:10 PM
that’s kindof what I thought 😞
so in order to do what I want, I’d need to write a logger plugin for core then right?
z

zwass

07/03/2019, 5:13 PM
What are you trying to achieve?
c

Chris Broome

07/03/2019, 5:16 PM
ideally i’d like to send status logs to something like aws cloudwatch but results logs to aws kineses
right now we have everything going to kinesis which means we have to filter “after-the-fact”
if that makes sense
z

zwass

07/03/2019, 5:17 PM
Yeah that makes sense. Are you using Fleet? Or is that just something you were looking at to understand this?
c

Chris Broome

07/03/2019, 5:18 PM
yeah we’re using fleet. but mainly this is for scheduled queries and not the distirbuted ones
looking for understanding more than anything else
just seeing what was possible and making sure i didn’t misread the osquery source code
z

zwass

07/03/2019, 5:22 PM
If you use the tls logger plugin in osquery and the logs make it to Fleet they will be separated into status and result logs. Fleet allows you to configure which files these write to. Fleet can also log status and results to separate Firehose streams. No Kinesis support as of now.
c

Chris Broome

07/03/2019, 5:26 PM
yeah I was looking at that and it might be our best option for now
thanks for being so responsive and helpful
z

zwass

07/03/2019, 5:27 PM
You could also write a custom logger plugin for osquery and do whatever you want with the logs on the hosts. This does not prevent you from using Fleet for live queries and config management.
c

Chris Broome

07/03/2019, 5:28 PM
indeed. I think a combination of the 2 is what I’ll end up doing long term. we have things running well right now with fleet and osquery, but we’re just looking to make some tweaks to our setup
z

zwass

07/03/2019, 5:28 PM
Sounds good. Good luck!
👍 1