clong
01/20/2023, 5:17 PMlogger_snapshot_event_type: true
in our config, but we're still seeing snapshot data come in as if it was set to false. Here's the options section of our config:
---
apiVersion: v1
kind: config
spec:
agent_options:
config:
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT computer_name AS hostname FROM system_info;
options:
disable_distributed: false
disable_events: false
distributed_interval: 10
distributed_plugin: tls
distributed_tls_max_attempts: 3
enable_keyboard_events: true
enable_mouse_events: true
logger_snapshot_event_type: true
logger_tls_endpoint: /api/osquery/log
logger_tls_period: 10
pack_delimiter: /
Is it possible I'm making a mistake somewhere, or is fleet not respecting this command line flag?{
action: snapshot
calendarTime: Fri Jan 20 17:08:26 2023 UTC
counter: 0
epoch: 0
hostIdentifier: host1
name: pack_MacPack_network_interfaces_snapshot
numerics: false
snapshot: [
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
]
unixTime: 1674234506
}
Log scheduled snapshot results as events, similar to differential results. If this is set to true, then each row from a snapshot query will be logged individually.
pack_delimiter
flag is also not being respected. I modified our config for the first time a few days ago -- how do I check the fleet server to see what flags it should be applying?Kathy Satterlee
01/20/2023, 5:44 PMclong
01/20/2023, 5:46 PMKathy Satterlee
01/20/2023, 5:48 PMclong
01/20/2023, 5:48 PMKathy Satterlee
01/20/2023, 5:51 PMclong
01/20/2023, 5:52 PMKathy Satterlee
01/20/2023, 7:07 PMcharles
01/20/2023, 9:56 PM