Just checking to see if my steps are correct so far:
1. After Creating a bundle using fleetctl package
2. Installing Debian package and enabling service
3. Confirming host was enrolled into Fleet through the console
4. Was able to run one off queries from the Fleet web console
After running the queries, there are no entries within osqueryd.results.log on the endpoint? Would I need to package in some osqueryd.flags to configure logging?
Should the results of the queries from the Fleet web console be saved under /logs/osqueryd.results.log (This is logging location set within the docker-compose file)? As mine seems to be empty
@Rachel Perkins So would it be common practice to schedule queries and export them from the Fleet server rather then exporting on each independent endpoint?
09/23/2021, 8:43 PM
Depending on what you're trying to do. Schedules is definitely better if you want a snapshot of all your hosts. You can also change the logging type, interval, etc so you don't end up with too much unwanted data