Chad Priest

12/10/2020, 6:11 PM
Hello everyone. šŸ‘‹ Iā€™m new to this group and to FleetDm. I first want to say that this is an awesome project and want to thank all that have contributed to it. I hope our team can contribute in the near future. I have a very noob question that I was wondering if someone could help point me in the right direction. We have the fleetDM base setup in K8 running on AWS where we can send osquery requests down to the client and we can see the results come back in the admin panel. We are looking for a way to store the results that come back in some sort of permanent data store, so we can further process and analyze them. Can anyone point me in the right direction to store these results in a DB and what might work best? Is this even possible? Any links or info is greatly appreciated.


12/10/2020, 7:14 PM
Please see this documentation on setting up resulot log files: https://github.com/fleetdm/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#filesystem You need to set the following flags filesystem_status_log_file and filesystem_result_log_file which will write the results to disk and then you can use your logging agent of choice to ship logs to a permanent datastore.


12/10/2020, 7:38 PM
Typically folks ship logs off to an aggregation platform like Splunk, ELK stack, or just S3. You can use the logging plugins in Fleet to get the scheduled query results to those destinations (as @CptOfEvilMinions was saying).