Hey, how can I force osqueryd daemons to restart uppon an update in the config flags from the server? I tried the

force=True

flag but its not working.

You can't force a restart of osquery from the remote APIs. It's not supported by osquery. Many configs can be dynamically changed while osquery is running, though. What are you trying to change?

The loggin plugin from

tls

to

aws_kinesis

A better way to change flags would be with your configuration management tooling. How do you deploy osquery in the first place?

What you mean by configuration management toooling? We update the config though

fleetctl

He probably means however you are laying down osquery and the flagfile. But I think you should be able to set the logging plugin via the TLS config. Did it not work?

It works, but requires the daemon to be restarted to start logging to the new plugin. We switched from

tls

plugin to

kinesis

but does not take effect until the daemon is restarted. Even tried to push the flag

--force=True

but also didnt work

the

force

flag is unrelated