Title
#kolide
a

Abraxas

09/18/2019, 6:49 PM
Apologies if this has been asked before - is there a way to control the client disk usage for osquery with Kolide? after the agent is deployed, can I set a size to start rolling over logs?
zwass

zwass

09/18/2019, 8:50 PM
Are you looking to do this on the host or the fleet server?
a

Abraxas

09/18/2019, 8:50 PM
all hosts in the fleet
8:51 PM
set it so that they don't ever store more than ~500mb or something like that
zwass

zwass

09/18/2019, 9:23 PM
Osquery doesn’t do log rotation, so you have to configure something else to do it. If you use the ‘tls’ logger plugin, Fleet can do log rotation on the server (see https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#filesystem_enable_log_rotation).
a

Abraxas

09/18/2019, 9:24 PM
awesome, thank you so much!