<@UBWUZESLB> osquery logs those to where you have ...
# kolideb
benbass
10/31/2018, 3:23 PM@R0n osquery logs those to where you have your logger_plugin configured to.
r
R0n
10/31/2018, 4:01 PMthey get log in the hosts? not sure where the logger_plugin gets set
b
benbass
10/31/2018, 4:07 PMYou can set the logger_plugin either from fleet or from your osquery.flags file.
r
R0n
10/31/2018, 4:39 PM Copy code
osquery:
node_key_size: 24
status_log_file: /tmp/osquery_status
result_log_file: /tmp/osquery_result
enable_log_rotation: false
label_update_interval: 1h0m0sR0n
10/31/2018, 4:39 PM?
b
benbass
10/31/2018, 4:47 PMDo you have logger_plugin set? I don’t know what it defaults to.
r
R0n
10/31/2018, 5:00 PMprobably not
R0n
10/31/2018, 5:01 PMif its not showing in conf dump
R0n
10/31/2018, 5:01 PMi did not setup the fleet, so im not sure how it got setup
b
benbass
10/31/2018, 5:42 PMGotcha. I would look to add a logger_plugin value, you can use TLS if you want the osquery logs to log to your fleet server of “filesystem” if you want the endpoints to log locally.
benbass
10/31/2018, 5:43 PMIf you do have them log locally make sure to set logger_path and logger_mode isn’t a bad idea either.
r
R0n
10/31/2018, 6:15 PMhow do u set those loggers?
R0n
10/31/2018, 6:15 PMfleetctl config set ?
b
benbass
10/31/2018, 7:30 PMfleetctl apply options
benbass
10/31/2018, 7:31 PMYou have to build your full options file. I would suggest grabbing what you have and writing it out to a file. Then adding what you need to a copy of that new file and applying the revised one.
benbass
10/31/2018, 7:31 PMThis way you have a copy of your existing options and can apply those back if necessary.
r
R0n
10/31/2018, 7:44 PM👍
R0n
10/31/2018, 7:45 PMsimilar to this one
https://github.com/kolide/fleet/blob/master/examples/config-single-file.yml
rightt? do you know the location of the current one?
R0n
10/31/2018, 7:48 PMfleet config_dumpR0n
11/01/2018, 2:10 PMi think i got it. ty for ur help
7 Views