``` options disable logging false disable events false sched

Question

``` options disable logging false disable events false schedule file events query SELECT FROM file events interval 10 yara signatures sig group 1 osquery osquery yar file paths www sig group 1 file paths www var www lt SNIP gt ```

Keith Swagler · Answer

Can you run ` verbose` when you run osquery and see if you have any Yara compile errors Also ensure that the file listener is setup on startup

Keith Swagler · Answer

Also make sure that you have file events enable as per the docs <https osquery readthedocs io en stable deployment file integrity monitoring >

yt0ng · Answer

Thanks for the response < Keith Swagler> I do not have any compile errors ```I0302 09 23 02 746310 1739991 yara utils cpp 426 Compiling YARA signature group sig group 1 I0302 09 23 02 884631 1739991 eventfactory cpp 156 Event publisher not enabled BPFEventPublisher Publisher disabled via configuration```

yt0ng · Answer

and I do get FIM events as long as I am not enabling the yara section above

yt0ng · Answer

I also get a confirmation for the event listening

yt0ng · Answer

```I0302 09 23 02 940120 1739991 file events cpp 87 Added file event listener to var www I0302 09 23 03 038489 1739991 yara events cpp 119 Added YARA listener to var www ```

yt0ng · Answer

I do get several things mentioned as not being active could that be an issue Also osquery tells me I am not providing the flagsfile which I actually do

yt0ng · Answer

```sudo osqueryd verbose flagfile= etc osquery osquery flags I0302 10 02 39 118822 1747822 init cpp 399 osquery initialized version=5 7 0 I0302 10 02 39 119309 1747822 extensions cpp 453 Could not autoload extensions Cannot open file for reading etc osquery extensions load I0302 10 02 39 119508 1747822 dispatcher cpp 78 Adding new service WatcherRunner 0x55e9051ac2b8 to thread 140318048220928 0x55e9051a9a80 in process 1747822 I0302 10 02 39 122210 1747823 watcher cpp 674 osqueryd watcher 1747822 executing worker 1747824 I0302 10 02 39 138759 1747824 init cpp 396 osquery worker initialized watcher=1747822 I0302 10 02 39 139111 1747824 dispatcher cpp 78 Adding new service WatcherWatcherRunner 0x55d8132e52b8 to thread 140406222186240 0x55d8132e49d0 in process 1747824 I0302 10 02 39 139307 1747824 rocksdb cpp 132 Opening RocksDB handle var osquery osquery db I0302 10 02 40 213364 1747824 dispatcher cpp 78 Adding new service ExtensionWatcher 0x55d813430448 to thread 140405609842432 0x55d813390050 in process 1747824 I0302 10 02 40 213515 1747824 dispatcher cpp 78 Adding new service ExtensionRunnerCore 0x55d813428688 to thread 140405618235136 0x55d8132f4c70 in process 1747824 I0302 10 02 40 213582 1747962 interface cpp 299 Extension manager service starting var osquery osquery em I0302 10 02 40 213652 1747824 auto constructed tables cpp 99 Removing stale ATC entries W0302 10 02 40 214896 1747824 options cpp 106 The CLI only flag config plugin set via config file will be ignored please use a flagfile or pass it to the process at startup W0302 10 02 40 214990 1747824 options cpp 106 The CLI only flag logger plugin set via config file will be ignored please use a flagfile or pass it to the process at startup I0302 10 02 40 215171 1747824 yara utils cpp 426 Compiling YARA signature group sig group 1 I0302 10 02 40 224817 1747824 eventfactory cpp 156 Event publisher not enabled BPFEventPublisher Publisher disabled via configuration I0302 10 02 40 225167 1747824 eventfactory cpp 156 Event publisher not enabled syslog Publisher disabled via configuration I0302 10 02 40 225662 1747824 events cpp 70 Skipping subscriber apparmor events Subscriber disabled via configuration I0302 10 02 40 227416 1747824 eventsubscriberplugin cpp 492 Found 10 events for subscriber inotify file events I0302 10 02 40 227855 1747824 events cpp 70 Skipping subscriber process file events Subscriber disabled via configuration I0302 10 02 40 228274 1747824 events cpp 70 Skipping subscriber seccomp events Seccomp subscriber disabled via configuration I0302 10 02 40 228595 1747824 events cpp 70 Skipping subscriber selinux events Subscriber disabled via configuration I0302 10 02 40 228765 1747824 events cpp 70 Skipping subscriber socket events Subscriber disabled via configuration I0302 10 02 40 307024 1747824 file events cpp 87 Added file event listener to var www I0302 10 02 40 307402 1747824 yara events cpp 119 Added YARA listener to var www ```

Keith Swagler · Answer

okay great can do 2 things run `select from osquery events` and make sure the yara events publisher is active and has events

Keith Swagler · Answer

and also create a test file and see if you can query it like `select from yara where path= file and sig group=sig group 1`

Keith Swagler · Answer

or `select from yara where path= file and sigfile= osquery osquery yar `

yt0ng · Answer

awesome thank you

yt0ng · Answer

gt `select from osquery events`

yt0ng · Answer

image png

yt0ng · Answer

I do see is active but no events

yt0ng · Answer

for

yt0ng · Answer

gt select from yara where path= file and sig group=sig group 1

yt0ng · Answer

I get

yt0ng · Answer

```osquery gt select from yara where path LIKE var www and sig group=sig group 1 Error no such column sig group 1```

yt0ng · Answer

I can however run

yt0ng · Answer

```select from yara where path= file and sigfile= osquery osquery yar ```

yt0ng · Answer

and get results

Keith Swagler · Answer

OK and using the osqueryi session can you modify the files and see if they show up in file events and yara events

yt0ng · Answer

you mean for FIM

yt0ng · Answer

if I modify a file

yt0ng · Answer

once I activate the yara section no more FIM events appear

Keith Swagler · Answer

yes

yt0ng · Answer

oh is that expected

Keith Swagler · Answer

It is not but I suspect there may be an issue between the config you are using for osqueryd and the one for osqueryi

Keith Swagler · Answer

this will check that

yt0ng · Answer

oh interesting

yt0ng · Answer

thank you for checking

yt0ng · Answer

will only be able to follow up tomorrow though so sorry for any late response and appreciate the help

Keith Swagler · Answer

okay let me know if that works +1

yt0ng · Answer

here are the config files in ` etc osquery `

yt0ng · Answer

```lrwxrwxrwx 1 root root 26 Mar 1 08 08 osquery flags default gt etc osquery osquery flags rw r r 1 root root 53 Mar 2 10 01 osquery yar rw r r 1 root root 75 Mar 2 10 08 osquery flags rw r r 1 root root 838 Mar 3 15 57 osquery conf drwxr xr x 155 root root 12K Mar 9 06 52 drwxr xr x 2 root root 4 0K Mar 9 08 03 ```

yt0ng · Answer

thats all I actually have

yt0ng · Answer

would there be another place where I should look

yt0ng · Answer

followed via strace that seems also to be where osqueryi is looking

yt0ng · Answer

```stat etc osquery osquery conf d 0x7ffe60b6b2f0 = 1 ENOENT No such file or directory openat AT FDCWD etc osquery osquery conf d O RDONLY|O NONBLOCK|O CLOEXEC|O DIRECTORY = 1 ENOENT No such file or directory stat etc osquery osquery conf st mode=S IFREG|0644 st size=838 = 0```

Keith Swagler · Answer

okay can you run `select from osquery flags`