Title
#kolide
h

heywoodlh

09/24/2019, 9:44 PM
Has anyone seen Kolide Launcher fill up the
/tmp
directory and know why that happens?
sundsta

sundsta

09/24/2019, 9:51 PM
If you didn't configure a TLS endpoint, the default location for osquery_status and osquery_result is in
/tmp
9:53 PM
Although... Launcher is opinionated so I don't think it can be configured without a TLS/gRPC endpoint
h

heywoodlh

09/24/2019, 9:54 PM
Thanks for the response @sundsta. I do have a TLS endpoint setup (Fleet), but it goes offline frequently as I'm doing experimenting in a lab environment. When Fleet goes offline, will it default back to logging results to
/tmp
?
sundsta

sundsta

09/24/2019, 10:01 PM
Only if you specified the
--root_directory
to be somewhere in
/tmp
h

heywoodlh

09/24/2019, 10:08 PM
Hmm. Well, I don't have that specified. I just have a systemd service that runs the following command:
/usr/local/bin/launcher \
     --hostname=$FleetServer:FleetPort \
     --enroll_secret=$FleetSecret \
     --autoupdate \
     --osqueryd_path=/usr/local/bin/osqueryd
10:09 PM
So according to your explanation, I still don't understand why it is logging to
/tmp
zwass

zwass

09/24/2019, 10:10 PM
If you don’t specify a database_path it will create a new path in /tmp each time it starts up. I’m guessing you have a bunch of old DBs lying around.
h

heywoodlh

09/24/2019, 10:10 PM
(hope that didn't come off as rude, I just still don't understand why it's doing this)
10:10 PM
Ah
10:10 PM
Yep
10:10 PM
@zwass that was it. Thanks. Any recommendations on a db path to use?
zwass

zwass

09/24/2019, 10:14 PM
Perhaps
/var/launcher/
. If you use package-builder it makes a path in
/var
.
h

heywoodlh

09/24/2019, 10:18 PM
That makes sense. Yeah, I've mostly used package-builder outside of this lab environment so I've never encountered this. Thanks for the explanation.
10:22 PM
@zwass how can I specify the database path? I'm not seeing it in the launcher documentation
zwass

zwass

09/24/2019, 10:23 PM
Ah sorry, the flag you want is
--root_directory
.
h

heywoodlh

09/24/2019, 10:23 PM
Okay, cool.