Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi guys, is there a way to configure the `overrides`  section for all linux platforms? In example, i want to enable `enable_syslog`  flag for all linux boxes, from what i see i need to have a section for ubuntu, rhel, centos... isnt it?

Also, it seems to me that if I have a `overrides` section for a platform (i,e:windows) and a flag does not exist in there, fleet will not look for it in the main section, am I right? Meaning, if I want to use `overrides` for a platform i need to configure all flags in the `overrides` section even if value is the same.

&gt; from what i see i need to have a section for ubuntu, rhel, centos... isnt it
Correct. Hosts receive override based on the platform returned by `SELECT platform FROM os_version`

&gt; fleet will not look for it in the main section, am I right?
You’re right. Overrides are NOT merged with the top level configuration. The entire config in overrides take precedence over the default config.

An example config file can be found <https://github.com/fleetdm/fleet/blob/master/docs/1-Using-Fleet/2-fleetctl-CLI.md#osquery-configuration-options|here in the documentation>.

Thanks Noah. Yeah i saw the config example, but i was not clear on the way it was working. Wanted to make sure that i was not doing anything wrong in my tests. Thanks!