Am i right in thinking that Fleet itself doesn't pull back and store the results of scheduled queries and that if I want access to those results I'll need to ship them to some form of log aggregator?
j
jussiu
06/26/2019, 1:06 PM
The results of scheduled queries are stored in results.log
But usually people forward from there to a log aggregator.
e
Ed
06/26/2019, 1:07 PM
On the endpoint filesystem as opposed to the fleet server itself?
b
benbass
06/26/2019, 1:13 PM
You can have the logger be the local filesystem on the endpoints, or use a tls logger which will send the logs to your fleet instance.
Either way you need a way to ship the logs off of your fleet server or the end points.
e
Ed
06/26/2019, 1:15 PM
Thanks, when using the tls logger, whereabouts on the fleetserver are those logs stored?