Dan Achin
11/04/2020, 5:59 PMzwass
11/04/2020, 6:03 PMDan Achin
11/04/2020, 6:16 PMzwass
11/04/2020, 6:18 PMDan Achin
11/04/2020, 6:18 PMzwass
11/04/2020, 7:57 PMDan Achin
11/04/2020, 8:54 PMzwass
11/05/2020, 6:05 AM--verbose --tls_dump
and see if your host is receiving the config you expect?Dan Achin
11/05/2020, 5:29 PMC02W28G1HTD6:infrastructure dachin$ sudo osqueryd --ephemeral --disable_database --disable_logging --verbose --tls_dump
I1105 10:26:38.275341 139969984 init.cpp:343] osquery initialized [version=4.4.0]
I1105 10:26:38.276684 139969984 extensions.cpp:383] Could not autoload extensions: Failed reading: /var/osquery/extensions.load
I1105 10:26:38.276727 139969984 dispatcher.cpp:77] Adding new service: WatcherRunner (0x7f863d705288) to thread: 0x70000098e000 (0x7f863d7045a0) in process 59573
I1105 10:26:38.277495 10018816 watcher.cpp:585] osqueryd watcher (59573) executing worker (59574)
I1105 10:26:38.295192 286705088 init.cpp:340] osquery worker initialized [watcher=59573]
I1105 10:26:38.298854 286705088 dispatcher.cpp:77] Adding new service: WatcherWatcherRunner (0x7ff8fac002b8) to thread: 0x7000083df000 (0x7ff8fac000c0) in process 59574
I1105 10:26:38.298998 286705088 dispatcher.cpp:77] Adding new service: ExtensionWatcher (0x7ff8fac00498) to thread: 0x700008462000 (0x7ff8fac003c0) in process 59574
I1105 10:26:38.299039 286705088 dispatcher.cpp:77] Adding new service: ExtensionRunnerCore (0x7ff8fac006a8) to thread: 0x7000084e5000 (0x7ff8fac00140) in process 59574
I1105 10:26:38.299090 286705088 auto_constructed_tables.cpp:96] Removing stale ATC entries
W1105 10:26:38.299268 286705088 init.cpp:602] Error reading config: config file does not exist: /var/osquery/osquery.conf
I1105 10:26:38.299289 286705088 events.cpp:866] Event publisher not enabled: openbsm: Publisher disabled via configuration
I1105 10:26:38.299297 286705088 events.cpp:866] Event publisher not enabled: scnetwork: Publisher not used
I1105 10:26:38.299302 286705088 events.cpp:866] Event publisher not enabled: event_tapping: Publisher disabled via configuration
I1105 10:26:38.299435 286705088 events.cpp:1125] Error registering subscriber: socket_events: Subscriber disabled via configuration
I1105 10:26:38.300441 286705088 main.cpp:103] Not starting the distributed query service: Distributed query service not enabled.
I1105 10:26:38.300451 139886592 events.cpp:785] Starting event publisher run loop: diskarbitration
I1105 10:26:38.300454 140423168 events.cpp:785] Starting event publisher run loop: fsevents
I1105 10:26:38.300475 286705088 dispatcher.cpp:77] Adding new service: SchedulerRunner (0x7ff8fad18018) to thread: 0x7000086f1000 (0x7ff8fad131a0) in process 59574
I1105 10:26:38.300468 140959744 events.cpp:785] Starting event publisher run loop: iokit
I1105 10:26:38.499281 139350016 interface.cpp:268] Extension manager service starting: /var/osquery/osquery.em
Is that what you were looking for?zwass
11/05/2020, 6:39 PMError reading config: config file does not exist: /var/osquery/osquery.conf
. Is this the same configuration you were using when you saw the error message (besides --verbose --tls_dump
)?Dan Achin
11/05/2020, 6:46 PMzwass
11/05/2020, 6:49 PMDan Achin
11/05/2020, 6:49 PMC02W28G1HTD6:infrastructure dachin$ cat /etc/osquery/osquery.flags
--enroll_secret_path=/etc/osquery/fleet_secret
--tls_hostname=<http://fleet-corp.nonprod.ppops.net:443|fleet-corp.nonprod.ppops.net:443>
--host_identifier=uuid
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=3600
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=60
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
zwass
11/05/2020, 6:51 PMosqueryd --flagfile /etc/osquery/osquery.flags --verbose --tls_dump
?Dan Achin
11/05/2020, 6:51 PM"packs": {
"AllHostsTest": {
"queries": {
"AllUsers": {
"query": "SELECT * FROM users",
"interval": 86400,
"platform": "",
"version": "",
"snapshot": true,
"removed": false
},
"Check Denied Queries": {
"query": "SELECT * FROM osquery_schedule WHERE denylisted='1';\n",
"interval": 600,
"platform": "",
"version": "",
"snapshot": true,
"removed": false
},
"Check osquery_schedule": {
"query": "SELECT * FROM osquery_schedule",
"interval": 3600,
"platform": "",
"version": "3.3.1",
"snapshot": true,
"removed": false
},
"T1053.004 - osx_launchd": {
"query": "SELECT path, label, program_arguments, inetd_compatibility, root_directory\nFROM launchd",
"interval": 3600,
"platform": "darwin",
"version": "3.3.1",
"snapshot": true,
"removed": false
},
"osquery_info": {
"query": "SELECT * FROM osquery_info",
"interval": 86400,
"platform": "",
"version": "3.3.1",
"snapshot": true,
"removed": false
}
}
},
"T1053 - Scheduled Task or Job": {
"queries": {
"T1053.003 - Mac/Linux Cron Tasks": {
"query": "SELECT * FROM crontab",
"interval": 86400,
"platform": "darwin,linux",
"removed": true
},
"T1053.004 - osx_launchd": {
"query": "SELECT path, label, program_arguments, inetd_compatibility, root_directory\nFROM launchd",
"interval": 86400,
"platform": "darwin",
"removed": true
},
"T1053.005 - T1053.002 - Windows Scheduled Tasks": {
"query": "SELECT * FROM scheduled_tasks",
"interval": 86400,
"platform": "windows",
"removed": true
}
}
}
}
}
zwass
11/05/2020, 7:00 PMDan Achin
11/05/2020, 7:13 PMzwass
11/05/2020, 7:33 PMDan Achin
11/05/2020, 7:37 PMzwass
11/05/2020, 7:38 PMDan Achin
11/05/2020, 7:39 PM