Title
#fleet
CptOfEvilMinions

CptOfEvilMinions

10/20/2021, 10:40 PM
Apologies in advance if I am asking a question that has been answered before but was unable to find. In a scenario where the
osquery.flags
file on the host has
--disable_carver=true
but fleet global options has
--disable_carver=false
, which one wins?
zwass

zwass

10/20/2021, 10:44 PM
As that flag is documented in the "command line flags" section of
osqueryd --help
, it should only be possible to set it via flagfile. If it's highly important I would give it a double-check and file an issue for osquery to resolve it if you find that it is respected in the TLS config.
CptOfEvilMinions

CptOfEvilMinions

10/20/2021, 10:50 PM
Totally forgot that
osqueryd --help
could answer my question. Thanks for the protip @zwass