@seph not that I'm aware of? I'm using the launcher from the git, and outside of the enroll secret and tls cert my only option is --osquery_flag logger_plugin=filesystem,windows_event_log

--osquery_flag logger_plugin=filesystem

tells osquery to write to the filesystem, it’s using the default path —

\Program Files\osquery\log\osqueryd.results.log

that directory doesn’t exists, so it’s an error

Ahh, filesystem option, I wondered if that was the case. Thanks for that info, it's been killing me.

You would typically set up the permissions as a part of the MSI installer flow.

it's the osquery service that stops it though, not the msi

The launcher MSI installs a launcher service. There should be no osquery service here.

I'm bad with words.

Ah. Happens sometimes. The osquery MSI installs an osquery service, so the detail matters

Yeah I'm probably completely misunderstanding how the logs work.

osquery runs queries. The results of those queries are logged. They may be logged to different places. Generally, if one is running a TLS server, that server handles distributing configuration and collecting logs.

I'm like a total newb. only option I'm changing besides the enroll secret, hostname, and tls cert is the logging plugin. It loads fine, hosts enroll, but then within about 5 minutes they go red/offline. Now I know that by setting the filesystem plugin, it's trying to create a file in that specific location (osquery folder).