Title
#windows
thor

thor

06/18/2019, 6:25 PM
@A Conno how are you doing it? just like
osqueryi "select * from windows_events" > my_file.txt"
?
a

A Conno

06/18/2019, 6:30 PM
just like that
thor

thor

06/18/2019, 6:31 PM
Ah ok, that wont work because
windows_events
is an event based table, meaning osquery has to be running interactively, so either dropping to the shell or running as the daemon, before any data will be generated
6:31 PM
You can read more about event based vs schedule based tables in the read the docs
a

A Conno

06/18/2019, 6:35 PM
got it - so if I want to get the results outside shell, need to use the daemon?
thor

thor

06/18/2019, 6:39 PM
Yeah for this instance you'd be better off using the daemon
a

A Conno

06/18/2019, 9:56 PM
thanks - I was way over-complicating things. just added a couple basic queries to the config, restarted daemon, and events started flowing into logs
9:58 PM
is there a manual way to flush an events table? i've tried significantly lowering events_expiry, but I don't think the flags file is being read
thor

thor

06/21/2019, 3:56 AM
The best you can do is to decrease the query interval to be very close together