https://github.com/osquery/osquery logo
Title
a

asparamancer

11/26/2020, 12:42 AM
should osquery be sending results from different queries in one request to the /logger endpoint on TLS? If so, is there a flag to stop this behaviour?
z

zwass

11/26/2020, 12:44 AM
Yes. The results are batched up and sent together.
I suppose you could set
--logger_tls_max_lines
to 1 to get this, but then you'd likely be accumulating logs faster than they were flushing. I don't think it would work well.
What are you trying to achieve?
a

asparamancer

12/16/2020, 12:31 PM
only just saw this, it was an issue with our endpoint parsing things strangely