https://github.com/osquery/osquery logo
Title
j

Jason

06/23/2022, 2:39 PM
I see that I can modify
osquery.flags
in the orbit root, but is there documentation for what flags are set by default by Orbit?
Specifically, I'm looking to see if the eBPF flag is set
t

tokcum

06/23/2022, 3:49 PM
I use this query to check for flags set and their default value.
SELECT * FROM osquery_flags
However, I do not see a eBPF flag in my environment today. Maybe you refer to
enable_bpf_events
flag?
j

Jason

06/23/2022, 3:57 PM
yes thats the tag
I didn't spell it out, but that is the one