Hey Folks! I made an error with the osquery 3.4.0 MSI that was released on github. The error has been fixed, I'm updating the binaries in the GH release page as well as those hosted in our S3 bucket, but wanted to drop the MSI here as well for folks who use that. Sorry about the mess up! osquery should now be installed in Program Files for all package deployments.
06/09/2019, 5:22 PM
Hi thor, I don't think this osquery3.4.0.msi is ready for prime time. I just ran on my system, and it correctly installed in c:\Program Files\osquery, however it's still writing to c:\ProgramData\osquery for
osqueryd.pidfile, and osquery.db
It's also looking in c:\ProgramData\osquery for extensions.load
Is that right? I built a new osqueryd from latest on git, and that daemon is looking for same in c:\Program Files\osquery.
Also uninstall is not removing files, and current build from git is not creating osqueryi
Let me know if I'm mistaken in my observations.
06/09/2019, 6:05 PM
we're facing the same issue with pidfile and osquery.db
06/11/2019, 7:26 PM
cc @thor ^^
06/11/2019, 8:23 PM
Yo! Yeah I have a commit landed upstream that fixes this issue but haven't made the binaries yet, I'm really sorry about that, I'll get them built when I can. I'm in a cabin in the woods for the week so don't have an opportunity to build the binaries for shipment, but I'll do this first thing next Monday morning or this weekend when I get back, really sorry about that folks!
The commit shipped, and I have the binaries built, but I must not have put them in the S3 bucket. The problem was the "home" variable specified in the binaries wasn't updated