Artem02/20/2021, 6:17 AM
but it's not going to have an effect (though it may show the value Fleet sent when you query
running locally may not be running the same flags as
(they could have been started with different flagfiles, and
likely has received some config from the Fleet server).
Artem02/21/2021, 9:43 AM
option in the osquery.flags as shown in the screenshot and running the osqueryd with this flagfile, I expected this flag to be correctly recognized when executing the
query from Fleet. Perhaps I do not fully understand what I am doing wrong, I ask you to explain please, but it seems to me that my actions are quite logical. I do not set any options for the watchdog separately via Fleet, all non-default values are indicated only in osquery.flags file. Therefore, I expected that I would get the same values for this parameter in osqueryd and osqueryi. Thank you!
SELECT * FROM osquery_flags where name='disable_watchdog'
to my flagfile I get the expected value of
when I live query the flag. My best guess is you are not running the flagfile you think you are, or you are setting the flag some other way.