https://github.com/osquery/osquery logo
Title
a

Abraxas

09/18/2019, 6:49 PM
Apologies if this has been asked before - is there a way to control the client disk usage for osquery with Kolide? after the agent is deployed, can I set a size to start rolling over logs?
z

zwass

09/18/2019, 8:50 PM
Are you looking to do this on the host or the fleet server?
a

Abraxas

09/18/2019, 8:50 PM
all hosts in the fleet
set it so that they don't ever store more than ~500mb or something like that
z

zwass

09/18/2019, 9:23 PM
Osquery doesn’t do log rotation, so you have to configure something else to do it. If you use the ‘tls’ logger plugin, Fleet can do log rotation on the server (see https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#filesystem_enable_log_rotation).
a

Abraxas

09/18/2019, 9:24 PM
awesome, thank you so much!