Hi , I know that Kolide server can log the results...
# kolide
Hi , I know that Kolide server can log the results osquery agents in a central log file. May I know where I can I see those logs? My osquery_result is empty
Check this out! https://github.com/kolide/fleet/blob/master/docs/infrastructure/working-with-osquery-logs.md Basically, default is
or you can set it to log whereever you want. if you don't see results there you have something wrong with the config
Thank you .. Will check
Also, check to see if you have anything scheduled to run 🙂
I think I've loaded packs in the past, but not enabled them and that's why I was not getting results...
Hey Joncrain.. No luck ..
can you kindly let me know which config file I should check ?
the config file may or may not be used. it's just the config that's used to startup fleet. https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md
can you verify that its running? run something like
ps aux | grep fleet
yes it is
do you have any packs installed?
I did the same way .. I passed --osquery_result_log_file flag while staring fleet
no I did not install any flag
I am just running query from GUI
someone from kolide may have to verify this, but I don't think adhoc queries get logged to the results file
you could save a query, create a new pack, enable it and add a host to check this
ohh is it .. will try running packs
I just created a sample pack and it is in enabled state
How should I run the packs now
It is very helpfull
Will check all the docs
before that I see some results in osquery_status
I guess its coming from the default osqueryd query which I have removed