George
02/18/2021, 8:58 AMcaller=level.go:63 level=info caller=log.go:69 component=osquery level=stderr msg="...
messages, has anyone else seen this issue?seph
02/18/2021, 2:12 PMcomponent=osquery level=stderr
indicates osquery is sending it to stderr.Get-EventLog -LogName Application -Source "launcher" -Newest 30 | select -ExpandProperty message
should give you the full errorGeorge
02/19/2021, 12:46 PMcaller=log.go:124 ts=2021-02-18T19:52:20.6552995Z caller=level.go:63 level=info caller=log.go:69 component=osquery level=stderr msg="I0218 19:52:20.655298 23212 distributed.cpp:121] Executing distributed query: kolide_label_query_17: SELECT name, build FROM os_version where build=17763" caller=distributed.cpp:121
caller=log.go:124 ts=2021-02-18T20:52:16.9077409Z caller=level.go:63 level=info caller=log.go:69 component=osquery level=stderr msg="I0218 20:52:16.907529 23212 interfaces.cpp:102] Failed to retrieve network statistics for interface 14" caller=interfaces.cpp:102
caller=log.go:124 ts=2021-02-18T19:52:10.5230024Z caller=level.go:63 level=info caller=log.go:69 component=osquery level=stderr msg="I0218 19:52:10.523001 23212 distributed.cpp:121] Executing distributed query: kolide_detail_query_uptime: select * from uptime limit 1" caller=distributed.cpp:121
level=stderr
is set for all results but as you can see from above, many of them aren't actual errorsseph
02/19/2021, 11:04 PMGeorge
02/22/2021, 9:42 AMseph
02/22/2021, 2:04 PMGeorge
02/22/2021, 3:48 PMApplications and Services Logs/Facebook/osquery
. Even just to ability to send the logs to a different event view rather than polluting the application log would be a bonus. This also means we can apply a maximum log size.seph
02/22/2021, 4:27 PM