Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi all, I just upgraded to latest Fleet 3.6.0 and I wanted to enquire about the Osquery Options page (`/admin/osquery`) (screenshot on the thread).

CleanShot 2021-01-18 at 16.48.17.png

We’re already configuring osquery flags via Ansible when we roll out osquery, so what happens in this situation, will Fleet try to override?

If these options take precedence what happens if we change one of them in the config file on a host (`/etc/osquery/osquery.flags)` ?

These do take precedence as they are loaded after the flag file. Please note that we did not change how this works, only added the editor in the UI. This is the same config you could edit previously with fleetctl.

Do they take immediate effect, or does osquery need a restart?

osquery checks in for configs on a configurable interval (`config_refresh`) and the configs will take effect immediately after it receives the new config (assuming they are not startup-only options).