Greetings! I'm trying out the extension for the fi...
# eclecticiq-polylogyx-extensiond
doteater
05/01/2019, 5:38 PMGreetings! I'm trying out the extension for the first time. I installed osqueryd and configured it to talk to my fleet server. Then I merged in the configs from the repo, and added the extension. When I start up osqueryd it seems to hang here:
Copy code
I0430 15:12:02.791899 9080 database.cpp:563] Checking database version for migration
I0430 15:12:04.289724 9592 interface.cpp:105] Registering extension (plgx_win_extension, 31328, version=1.0.28, sdk=3.2.6)doteater
05/01/2019, 5:41 PMActually now I realize I'm using fleet instead of the local filesystem for conf - that must be the issue?
doteater
05/01/2019, 6:05 PMNow I switched to local filesystem conf, at first my config wouldn't parse due to clumsy edits - but new tables were working via direct queries from fleet. Now that I've gotten the config fixed I get this error:
Copy code
E0501 11:02:56.950307 8236 init.cpp:593] Cannot activate filesystem logger plugin: Could not create file: \ProgramData\osquery\log\osqueryd.results.logm
manu
05/01/2019, 6:08 PMit does support both local/tls config. looking at ur logs it seems you don't have
logc:\programdata\osquery\manu
05/01/2019, 6:08 PMcan you please check if not then create the folder manually
manu
05/01/2019, 6:09 PMalso make sure that you are running osquery
3.2.6manu
05/01/2019, 6:11 PMthis is a sample config for local filesystem https://github.com/polylogyx/osq-ext-bin/blob/master/osquery.flags
d
doteater
05/01/2019, 6:15 PMThanks for the confirmation @manu - I just realized that error was just because the file already existed, once I removed the existing results log the error went away. Restarting service also doesn't show the error again - maybe there was some kind of permission issue with the existing log file.
m
manu
05/01/2019, 6:16 PMgreat
manu
05/01/2019, 6:18 PMinfact when u would be running and switch between shell and as a service u would be facing permission for db, that's very common in the beginning too.
manu
05/01/2019, 6:19 PMthe soln to that prob is to either point to a diff db in ur flagsfile or takeownership of the folder or remove it altogether, if u r just experimenting.
8 Views