Hey friends I ve spun up osquery on a test macos machine Ven

Question

Hey friends I ve spun up osquery on a test macos machine Ventura I used brew to install 5 7 0 and ran `sudo osqueryctl start` after copying the example configuration file to osquery conf I ve been playing around with the packs here <https github com chainguard dev osqtool> but for reasons that aren t apparent to me I m getting errors about tables missing in var log osquery osqueryd INFO ```E0218 19 28 57 638203 2145783808 scheduler cpp 128 Error executing scheduled query pack odk detection sketchy fetcher events no such table process events E0218 19 29 05 149111 2145783808 scheduler cpp 128 Error executing scheduled query pack odk detection unexpected privilege escalation macos no such table signature E0218 19 29 16 931692 2145783808 scheduler cpp 128 Error executing scheduled query pack odk detection unexpected env values macos no such table process envs``` I even took the output here `osqueryi list select name default value from osquery flags` and after text replacing and adding to the beginning of each line sent the results to osquery flags to make sure the defaults were all set osqueryi sees those tables just fine I did add osquery to Full Disk Access in macos perms What am I missing here I see osqueryd running as root in `ps` output I ve attempted to toggle some of the settings like enabling most of the audit allow choices and making sure the relevant disable settings were set to false

Ian · Answer

I did see this at the top of that log file but don t have a clue which configuration flag is disabling the event tapping publisher or why the system configuration network publisher is not used ```I0218 21 06 33 474051 241893056 eventfactory cpp 156 Event publisher not enabled scnetwork Publisher not used I0218 21 06 33 474445 241893056 eventfactory cpp 156 Event publisher not enabled event tapping Publisher disabled via configuration```

Ian · Answer

Okay this is really strange ```$ ls la var osquery osquery em srwxr xr x 1 root wheel 0 Feb 18 21 06 var osquery osquery em $ sudo osqueryi Password Using a virtual database Need help type help osquery gt connect var osquery osquery em Connected to extension socket var osquery osquery em for debugging osquery gt select from osquery info Error no such table osquery info osquery gt ``` Is this some kinda macOS M processor thing Guess I ll try uninstalling the brew package and see if I get better results with the normal pkg installer

Ian · Answer

That didn t make a difference however if I remove that osquery flags file and replace it with an empty file I m at least able to query the osquery info table after connecting It s got to be something about that osquery flags file

Ian · Answer

kk got it working by just truncating all the default stuff out of that flags file Now all it contains is ``` audit allow fim events=true audit allow process events=true audit allow sockets=true audit allow user events=true disable endpointsecurity=false disable endpointsecurity fim=false enable file events=true enable keyboard events=true enable mouse events=true enable yara string=true``` curious if anyone here can spot which of those entries is hosing osquery like that One thing I tried was removing all lines that didn t have a value after the equals sign but that didn t help

Stefano Bonicatti · Answer

` enable tables=processes` is the cause likely that disables everything else except that table

Stefano Bonicatti · Answer

Also that s not a default the default is empty