Does logger mode have to be set via the command line flags o

Question

Does logger mode have to be set via the command line flags or can we manage it with fleet I am using the filesystem logger and trying to get `644` set as the permissions on the osquery results log on the endpoints Using tls dump I can see that logger mode is being sent to the endpoint it just doesn t look like it is being implemented by osquery 5 0 1

zwass · Answer

gt Does logger mode have to be set via the command line flags or can we manage it with fleet In theory it should be configurable by Fleet as it is document as an option in osquery I ve seen plenty of osquery options not respecting this in the past though Is there possibly some issue with returning a string value vs integer value

benbass · Answer

I think it has been configurable in versions 4 9 and earlier of osquery The settings don t seem to be respected by version 5 0 1 though

benbass · Answer

I do know that there were some changes in how the logger mode is implemented in osquery I know when I set it in the flag file I have to use ` logger mode=0644` and when I set `0644` in fleet fleet resets the configs to the previous version

benbass · Answer

the changes in fleet were done in the fleet GUI via the Global agent options

benbass · Answer

When I do the TLS debug I am seeing the settings being sent by fleet just osquery isn t respecting them

zwass · Answer

Maybe you need it in quotes for Fleet

benbass · Answer

I tried that and it passed the value but the permissions on the file did not change nor were they set properly on a freshly created log