OMAR
08/16/2019, 10:06 PMfilesystem:
status_log_file: /var/log/osquery/status.log
result_log_file: /var/log/osquery/result.log
osquery:
status_log_plugin: filesystem
result_log_plugin: filesystem
I did notice that the results are being written to /var/log/syslog
, but the output there is from whatever /usr/bin/fleet
writes to stdout, which isn't in the most optimal form for shipping logs and making them searchable. Is there something I'm missing here?
I found the /var/log/syslog by grepping the entire filesystem for results from a scheduled query. basically grep -cri 'aapocclcgogkmnckokdopfmhonfmgoek' / 2>/dev/null | grep -v :0
to see where this chrome extension shows up, and it's only in the syslog file, not ever /var/log/osquery/*
David Gagliardi
08/19/2019, 3:47 PMOMAR
08/19/2019, 3:48 PMsundsta
08/19/2019, 3:50 PMDavid Gagliardi
08/19/2019, 3:50 PMsundsta
08/19/2019, 3:51 PMDavid Gagliardi
08/19/2019, 3:51 PMOMAR
08/19/2019, 3:52 PMsundsta
08/19/2019, 3:54 PMosquery_status
but not osquery_result
?OMAR
08/19/2019, 3:55 PMsundsta
08/19/2019, 3:56 PMsudo journalctl -u fleet
) and verify it sets up the osquery_result
writer without errorsOMAR
08/19/2019, 3:56 PMDavid Gagliardi
08/19/2019, 4:05 PMOMAR
08/19/2019, 4:06 PM