Title
#kolide
g

groob

02/19/2019, 2:07 PM
specify multiple logger plugins in your config
y

Yegor

02/20/2019, 1:30 PM
I run osquery with this command:
/usr/bin/osqueryd --flagfile /etc/osquery/osqueryNEW.flags
osqueryNEW.flags
--tls_server_certs=/etc/ssl/certs/Root_CA.pem
--tls_hostname=fleet.localhost
--enroll_tls_endpoint=/api/v1/osquery/enroll
--enroll_secret_path=/etc/osquery/enroll.txt
--config_plugin=filesystem
--config_path=/etc/osquery/osqueryNEW.conf
--host_identifier=uuid
--disable_distributed=false
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_event_type=true
--debug
--verbose
--tls_dump
/etc/osquery/osqueryNEW.conf
{
  "decorators": {
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;"
    ]
  },
  "options": {
    "disable_distributed": false,
    "distributed_interval": 10,
    "distributed_plugin": "tls",
    "distributed_tls_max_attempts": 3,
    "distributed_tls_read_endpoint": "/api/v1/osquery/distributed/read",
    "distributed_tls_write_endpoint": "/api/v1/osquery/distributed/write",
    "logger_plugin": "tls,filesystem",
    "logger_tls_endpoint": "/api/v1/osquery/log",
    "logger_tls_period": 10,
    "pack_delimiter": "/"
  },
  "packs": {
    "fim": "/usr/share/osquery/packs/fim.conf",
    "hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
    "incident-response": "/usr/share/osquery/packs/incident-response.conf",
    "it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
    "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
    "ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf",
    "vuln-management": "/usr/share/osquery/packs/vuln-management.conf"
  }
}
But osquery doesn't write anything into osqueryd.results.log