Arsenio
11/09/2022, 5:54 PMconfig:
options:
logger_plugin: tls
pack_delimiter: /
logger_tls_period: 10
distributed_plugin: tls
disable_distributed: false
logger_tls_endpoint: /api/osquery/log
distributed_interval: 10
distributed_tls_max_attempts: 3
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
command_line_flags: {} # requires Fleet's osquery installer
This is the default we have.Benjamin Edwards
11/09/2022, 6:29 PMKathy Satterlee
11/09/2022, 6:29 PMSELECT name, default_value, value FROM osquery_flags WHERE name LIKE "%carver%";
Arsenio
11/09/2022, 8:19 PMKathy Satterlee
11/09/2022, 9:01 PMlogger_plugin
is a command-line flag and shouldn't be set through config
. osquery has gotten a lot more particular about that of late, so we added some validation on our end.
If you're using Orbit, you can set it under `command_line_flags'.
All that being said, you shouldn't have any problems if you remove it.