Apologies in advance if I am asking a question that has been answered before but was unable to find. In a scenario where the

osquery.flags

file on the host has

--disable_carver=true

but fleet global options has

--disable_carver=false

, which one wins?

As that flag is documented in the "command line flags" section of

osqueryd --help

, it should only be possible to set it via flagfile. If it's highly important I would give it a double-check and file an issue for osquery to resolve it if you find that it is respected in the TLS config.

Totally forgot that

osqueryd --help

could answer my question. Thanks for the protip @zwass