I have a mutual question. Is there a way to check ...
# kolide
y
I have a mutual question. Is there a way to check out host configuration when running
osqueryd
with
launcher
and
fleet
? I'm trying to set up the simplest one-file configuration for
filesystem
logger plugin, but no logs are created. This is it:
z
If you run Launcher with —debug you can see the config it is receiving
y
I queried osquery flags through fleet's web interface and found out that everything is set from config except for
logger_plugin
which is always set to
kolide_grpc
. How can I add another logger to the list so it isn't erased? The problem seems to correlate with this issue (https://github.com/kolide/fleet/issues/1584)
z
Launcher starts up osquery with that flag for the logger plugin, but it should be overwritten by the config received from the server. Can you try running with
--debug
to see what config it receives?
y
It seems to be I have a problem with configuration though distributed queries work.
z
initial run results: unmarshal osquery config blob: json: cannot unmarshal string into Go struct field Decorators.interval of type []string
Try enclosing the interval in quotes.
Please let me know if that fixes it. I can update the examples in the docs as appropriate.
y
Quotes made the error disappear but
kolide_grpc
is still the only logger plugin.
z
@seph does the debug logging not include config responses?
s
Offhand, I don’t know. I’d have to look at the code