groob
02/19/2019, 2:07 PMYegor
02/20/2019, 1:30 PM/usr/bin/osqueryd --flagfile /etc/osquery/osqueryNEW.flags
osqueryNEW.flags
--tls_server_certs=/etc/ssl/certs/Root_CA.pem
--tls_hostname=fleet.localhost
--enroll_tls_endpoint=/api/v1/osquery/enroll
--enroll_secret_path=/etc/osquery/enroll.txt
--config_plugin=filesystem
--config_path=/etc/osquery/osqueryNEW.conf
--host_identifier=uuid
--disable_distributed=false
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_event_type=true
--debug
--verbose
--tls_dump
/etc/osquery/osqueryNEW.conf
{
"decorators": {
"load": [
"SELECT uuid AS host_uuid FROM system_info;"
]
},
"options": {
"disable_distributed": false,
"distributed_interval": 10,
"distributed_plugin": "tls",
"distributed_tls_max_attempts": 3,
"distributed_tls_read_endpoint": "/api/v1/osquery/distributed/read",
"distributed_tls_write_endpoint": "/api/v1/osquery/distributed/write",
"logger_plugin": "tls,filesystem",
"logger_tls_endpoint": "/api/v1/osquery/log",
"logger_tls_period": 10,
"pack_delimiter": "/"
},
"packs": {
"fim": "/usr/share/osquery/packs/fim.conf",
"hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
"incident-response": "/usr/share/osquery/packs/incident-response.conf",
"it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
"osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
"ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf",
"vuln-management": "/usr/share/osquery/packs/vuln-management.conf"
}
}
But osquery doesn't write anything into osqueryd.results.log