Ibra
06/14/2022, 2:09 PMKathy Satterlee
06/14/2022, 6:19 PMosquery_detail_update_interval
, which is set to 30 min by default. You can check out all of the configuration options in the documentation.
If that doesn't answer your question, just let me know more about the info you're wanting to keep more up to date and I'll be happy to take a look.Ibra
06/14/2022, 7:26 PMosquery:
node_key_size: 24
host_identifier: provided
enroll_cooldown: 0s
status_log_plugin: filesystem
result_log_plugin: filesystem
label_update_interval: 1h0m0s
policy_update_interval: 1h0m0s
detail_update_interval: 1h0m0s
status_log_file: ""
result_log_file: ""
enable_log_rotation: false
max_jitter_percent: 10
enable_async_host_processing: "false"
async_host_collect_interval: 30s
async_host_collect_max_jitter_percent: 10
async_host_collect_lock_timeout: 1m0s
async_host_collect_log_stats_interval: 1m0s
async_host_insert_batch: 2000
async_host_delete_batch: 2000
async_host_update_batch: 1000
async_host_redis_pop_count: 1000
async_host_redis_scan_keys_count: 1000
min_software_last_opened_at_diff: 1h0m0s
Kathy Satterlee
06/14/2022, 8:31 PMFLEET_OSQUERY_DETAIL_UPDATE_INTERVAL=30m
By applying a flag when starting the server:
fleet serve --osquery_detail_update_interval=30m
Or by creating a .yml
file with the value(s) you want to set:
osquery:
detail_update_interval:30m
And then specifying that file when starting the server:
fleet serve --config <your file>.yml
/usr/bin/fleet serve \
--mysql_address=127.0.0.1:3306 \
--mysql_database=fleet \
--mysql_username=root \
--mysql_password=toor \
--redis_address=127.0.0.1:6379 \
--server_cert=/tmp/server.cert \
--server_key=/tmp/server.key \
--logging_json
The simplest/closest to what you're already doing option would be to add it as a command-line flag to that command:
/usr/bin/fleet serve \
--mysql_address=127.0.0.1:3306 \
--mysql_database=fleet \
--mysql_username=root \
--mysql_password=toor \
--redis_address=127.0.0.1:6379 \
--server_cert=/tmp/server.cert \
--server_key=/tmp/server.key \
--osquery_detail_update_interval=30m \
--logging_json
Ibra
06/15/2022, 7:14 AM