dinh.bui
03/02/2023, 10:31 AMKathy Satterlee
03/02/2023, 3:13 PMdinh.bui
03/02/2023, 4:17 PMKathy Satterlee
03/02/2023, 5:37 PM{}
was left in there.
This won't work:
command_line_flags: {}
enable_file_events: true
This will:
command_line_flags:
enable_file_events: true
dinh.bui
03/03/2023, 7:18 AMconfig:
options:
pack_delimiter: /
logger_tls_period: 10
distributed_plugin: tls
disable_distributed: false
logger_tls_endpoint: /api/osquery/log
distributed_interval: 10
distributed_tls_max_attempts: 3
decorators:
load:
- SELECT version FROM osquery_info
- SELECT uuid AS host_uuid FROM system_info
always:
- >-
SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY
time LIMIT 1
command_line_flags:
events_max: 500000
audit_persist: true
disable_audit: false
events_expiry: 1
disable_events: false
audit_allow_config: true
enable_file_events: true
logger_rotate_size: 26214400
audit_allow_sockets: true
watchdog_memory_limit: 150
logger_rotate_max_files: 5
audit_allow_process_events: true
watchdog_utilization_limit: 130
distributed_interval
setting." And I config the flag "--distributed_interval=10" in the "/opt/orbit/osquery.flags". It did not work.
By the way, do you know how long the orbit will fetch the flag configuration that was config in Fleet UI?