Mystery Incorporated

Mystery Incorporated

06/24/2021, 7:29 AM
Does osquery either report to fleet OR write to a local log or can it do both?

Silvano Ngacha

06/24/2021, 8:11 AM
I think its possible.Multiple logger plugins may be used simultaneously, effectively copying logs to each interface. To enable multiple loggers set the --logger_plugin option to a comma separated list, do not include spaces, of the requested plugins.
https://osquery.readthedocs.io/en/4.4.0/deployment/logging/ ``````