Hi all, I'm currently trying to configure

kolide_grpc

and

filesystem

loggers for launcher. The logs are being sent to the fleet server just fine, however, no results appear on the filesystem. My options file is:

apiVersion: v1
kind: options
spec:
  config:
    decorators:
      always:
      - SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time
        LIMIT 1
      interval:
        "3600": SELECT total_seconds AS uptime FROM uptime
      load:
      - SELECT version FROM osquery_info
      - SELECT uuid AS host_uuid FROM system_info
    options:
      config_plugin: kolide_grpc
      disable_events: false
      distributed_interval: 3
      distributed_tls_max_attempts: 3
      events_max: 8
      logger_path: /var/log/launcher/results
      logger_plugin: kolide_grpc,filesystem
      verbose: true
      watchdog_level: -1
  overrides: {}

Is there something I've missed? Cheers

Did the daemon got restarted? We had several scenarios where we changed the loggin plugin and until the daemon was restarted, it still report to the previous plugin

Yep, nothing seems to work, I get no errors or anything either, quite difficult to debug.

Important question here would be what do you have in the

osquery.flags

file?

I thought it might be something to do with this, however, I'm using launcher and launcher builder, is there a way to set the flags when building the package? Documentation seems to suggest not. If I

ps aux | grep launcher

I get this:

/usr/local/launcher/bin/osqueryd --pidfile=/var/launcher/<host>5/osquery.pid --database_path=/var/launcher/<host>/osquery.db --extensions_socket=/var/launcher/<host>/osquery.sock --extensions_autoload=/var/launcher/<host>/osquery.autoload --extensions_timeout=10 --config_plugin=kolide_grpc --logger_plugin=kolide_grpc --distributed_plugin=kolide_grpc --disable_distributed=false --distributed_interval=5 --pack_delimiter=: --host_identifier=uuid --force=true --disable_watchdog --utc --verbose --config_refresh=300 --config_accelerated_refresh=30

where the logger_plugin is

kolide_grpc

, but the docs say whatever's in the fleet options will override anything else

Hmm interesting