Title
#windows
CAN KANSIN

CAN KANSIN

08/31/2018, 8:30 AM
Hi, despite the fact I am sending node_invalid=true response for every osquery request (after a while, only for enrollment requests, obviously), in my osqueryd logs I can see that it’s still executing the queries of my last configuration. AFAIU this can help me to catch the logs that I cannot get while I disconnected from my client as a server, but this shouldn’t be the happening because I send node_invalid=true. I want it to stop what it was doing till I give a new order. For my project I do not want it to run like this forever in the client. Is there any way to stop osqueryd client to just send enrollment request like you run it for the first time? (configuration is tls and osqueryd is running on windows) thanks 🙂 @thor
9:47 AM
I also asked a similar question before