Artem
02/20/2021, 6:17 AMzwass
02/20/2021, 7:15 PMdisable_watchdog=true
but it's not going to have an effect (though it may show the value Fleet sent when you query osquery_flags
).osqueryi
running locally may not be running the same flags as osqueryd
(they could have been started with different flagfiles, and osqueryd
likely has received some config from the Fleet server).Artem
02/21/2021, 9:43 AM--disable_watchdog
option in the osquery.flags as shown in the screenshot and running the osqueryd with this flagfile, I expected this flag to be correctly recognized when executing the SELECT * FROM osquery_flags where name='disable_watchdog'
query from Fleet.
Perhaps I do not fully understand what I am doing wrong, I ask you to explain please, but it seems to me that my actions are quite logical.
I do not set any options for the watchdog separately via Fleet, all non-default values are indicated only in osquery.flags file.
Therefore, I expected that I would get the same values for this parameter in osqueryd and osqueryi.
Thank you!zwass
02/21/2021, 5:46 PM--disable_watchdog
to my flagfile I get the expected value of true
when I live query the flag. My best guess is you are not running the flagfile you think you are, or you are setting the flag some other way.