https://github.com/osquery/osquery logo
Title
a

AoS

07/14/2019, 11:09 AM
Is this possible through fleet?
z

zwass

07/14/2019, 7:51 PM
No, and I would guess this is a startup flag and can’t be changed through Fleet anyway. I don’t think either fleet or osquery will complain but I think it will have no effect. I’m on mobile so can’t check to be sure.
a

AoS

07/16/2019, 11:36 AM
You're right, just checked and it doesn't work. A weird thing is that although it doesn't work, when quering osquery_flags from the UI it shows as if it did.
z

zwass

07/16/2019, 4:39 PM
Yeah osquery will take and store the value but it will be after the time it would take effect. It would be great if we could get osquery to at least spit out a warning when a startup flag is provided in a later config.