https://github.com/osquery/osquery logo
Title
r

Ryan

01/18/2021, 4:48 PM
Hi all, I just upgraded to latest Fleet 3.6.0 and I wanted to enquire about the Osquery Options page (
/admin/osquery
) (screenshot on the thread).
this is the default value:
We’re already configuring osquery flags via Ansible when we roll out osquery, so what happens in this situation, will Fleet try to override?
If these options take precedence what happens if we change one of them in the config file on a host (
/etc/osquery/osquery.flags)
?
z

zwass

01/19/2021, 12:07 AM
These do take precedence as they are loaded after the flag file. Please note that we did not change how this works, only added the editor in the UI. This is the same config you could edit previously with fleetctl.
r

Ryan

01/20/2021, 10:43 AM
Ok cool, thanks!
Do they take immediate effect, or does osquery need a restart?
z

zwass

01/20/2021, 3:29 PM
osquery checks in for configs on a configurable interval (
config_refresh
) and the configs will take effect immediately after it receives the new config (assuming they are not startup-only options).
👍 1
r

Ryan

01/20/2021, 4:13 PM
great, thanks for the clarification