Title
#fleet
Mystery Incorporated

Mystery Incorporated

08/13/2021, 11:10 AM
It's alleged that the watchguard is watching for hard set "osqueryd" process to monitor resource usage, and that may be causing it to crashe when the binary is renamed and launched as a service. You can follow what I did here if you want to pick up where I left off: https://osquery.slack.com/archives/C08V7KTJB/p1628315545078400
m

Madhur Jodhwani

08/13/2021, 12:55 PM
it means it can’t be renamed?
Mystery Incorporated

Mystery Incorporated

08/14/2021, 12:25 PM
@Madhur Jodhwani not without disabling the watchguard (allegedly)
m

Madhur Jodhwani

08/15/2021, 4:37 AM
oh ok