osquery logs those to where you have your logger plug

Question

< R0n> osquery logs those to where you have your logger plugin configured to

R0n · Answer

they get log in the hosts not sure where the logger plugin gets set

benbass · Answer

You can set the logger plugin either from fleet or from your osquery flags file

R0n · Answer

``` osquery node key size 24 status log file tmp osquery status result log file tmp osquery result enable log rotation false label update interval 1h0m0s ```

benbass · Answer

Do you have logger plugin set I don t know what it defaults to

R0n · Answer

probably not

R0n · Answer

if its not showing in conf dump

R0n · Answer

i did not setup the fleet so im not sure how it got setup

benbass · Answer

Gotcha I would look to add a logger plugin value you can use TLS if you want the osquery logs to log to your fleet server of filesystem if you want the endpoints to log locally

benbass · Answer

If you do have them log locally make sure to set logger path and logger mode isn t a bad idea either

R0n · Answer

how do u set those loggers

R0n · Answer

fleetctl config set

benbass · Answer

fleetctl apply options

benbass · Answer

You have to build your full options file I would suggest grabbing what you have and writing it out to a file Then adding what you need to a copy of that new file and applying the revised one

benbass · Answer

This way you have a copy of your existing options and can apply those back if necessary

R0n · Answer

+1

R0n · Answer

similar to this one <https github com kolide fleet blob master examples config single file yml> rightt do you know the location of the current one

R0n · Answer

`fleet config dump` the location of that yaml i get after running config dump

R0n · Answer

i think i got it ty for ur help