jby
12/02/2020, 8:44 AMosquery-in-a-box
setup, I can populate it with data from a Linux (Fedora 32) host by running osqueryd manually from the command line:
osqueryd --flagfile /etc/osquery/flags.txt --config_path /etc/osquery/osquery.conf
But starting osqueryd using systemctl doesn’t work, I’ve checked /etc/sysconfig/osqueryd and it points to the same files as I point to running it manually (and can be verified by running ps
after starting) but still it doesn’t communicate with my fleet instance.
Anyone seen the same and found a solution?Ryan
12/02/2020, 11:04 AMjby
12/02/2020, 11:18 AMRyan
12/02/2020, 1:32 PMAfter=network.target
jby
12/02/2020, 1:33 PMRyan
12/02/2020, 1:33 PM[Unit]
Description=osquery
Documentation=<https://osquery.io>
After=network.target
[Service]
# Daemon flags from: <https://osquery.readthedocs.io/en/stable/installation/cli-flags/>
ExecStart=/usr/bin/osqueryd --enroll_secret_path=/var/osquery/enroll_secret \
--tls_server_certs=/var/osquery/fleet.pem \
--tls_hostname={{ osquery_fleet_server }} \
--host_identifier=hostname \
--enroll_tls_endpoint=/api/v1/osquery/enroll \
--config_plugin=tls \
--config_tls_endpoint=/api/v1/osquery/config\
--config_refresh=10 \
--disable_distributed=false \
--distributed_plugin=tls \
--distributed_interval=3 \
--distributed_tls_max_attempts=3 \
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read \
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write \
--logger_plugin=tls \
--logger_tls_endpoint=/api/v1/osquery/log \
--logger_tls_period=10 \
--watchdog_level=0 \
--watchdog_delay=60 \
--utc=true \
--schedule_splay_percent=10 \
--schedule_max_drift=60 \
--extensions_autoload=/etc/osquery/extensions.load \
--extensions_timeout=5 \
--extensions_interval=5
Restart=always
[Install]
WantedBy=multi-user.target
jby
12/02/2020, 1:35 PMRyan
12/02/2020, 1:36 PMjby
12/02/2020, 1:39 PMRyan
12/02/2020, 1:59 PMjby
12/02/2020, 2:01 PMRyan
12/02/2020, 3:13 PMjby
12/02/2020, 3:14 PMRyan
12/02/2020, 3:19 PMjby
12/02/2020, 3:32 PMzwass
jby
12/02/2020, 4:33 PM