Title
#fleet
a

Arsenio

11/09/2022, 5:54 PM
Hello testing the file carving functionality. We have the carves going to an S3 bucket but the few I have tested return as 1KB in size. Are there agent option we have to enable?
config:
  options:
    logger_plugin: tls
    pack_delimiter: /
    logger_tls_period: 10
    distributed_plugin: tls
    disable_distributed: false
    logger_tls_endpoint: /api/osquery/log
    distributed_interval: 10
    distributed_tls_max_attempts: 3
  decorators:
    load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
command_line_flags: {} # requires Fleet's osquery installer
This is the default we have.
6:16 PM
also is there documentation on all the possible options? tried finding it on osquery docs but not sure where they are at
Benjamin Edwards

Benjamin Edwards

11/09/2022, 6:29 PM
Kathy Satterlee

Kathy Satterlee

11/09/2022, 6:29 PM
There's a good breakdown of the osquery carving flags: https://fleetdm.com/docs/using-fleet/fleetctl-cli#configuration You can check the current settings on your host(s) by running this query from Fleet:
SELECT name, default_value, value FROM osquery_flags WHERE name LIKE "%carver%";
6:30 PM
@Benjamin Edwards Was quicker on the draw this time 🙂
a

Arsenio

11/09/2022, 8:19 PM
thank you @Benjamin Edwards and @Kathy Satterlee you all are great with the support!
8:51 PM
when trying to save, i get this error message
8:52 PM
if i remove the logger_plugin, will that affect the agents ability to communicate with the server?
Kathy Satterlee

Kathy Satterlee

11/09/2022, 9:01 PM
Are you using Orbit, or vanilla osquery?
logger_plugin
is a command-line flag and shouldn't be set through
config
. osquery has gotten a lot more particular about that of late, so we added some validation on our end. If you're using Orbit, you can set it under `command_line_flags'. All that being said, you shouldn't have any problems if you remove it.