Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert plugin options to flags #5

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Convert plugin options to flags #5

wants to merge 2 commits into from

Conversation

brettt89
Copy link

Osquery 5.4 now requires certain options to be passed as "flags" to osquery daemon.
https://osquery.readthedocs.io/en/stable/deployment/configuration/#options

There are LOTs of CLI flags that CANNOT be set with the options key. These flags determine the start and initialization of osquery and configuration loading usually depends on these CLI-only flags. Refer to the --help list to determine the appropriateness of options.

These changes fix the following errors on Ubuntu 22.04 (Jammy)

W0812 14:55:46.141168  6776 options.cpp:106] The CLI only flag --config_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
W0812 14:55:46.141561  6776 options.cpp:106] The CLI only flag --logger_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
W0812 14:55:46.141685  6776 options.cpp:101] Cannot set unknown or invalid flag: enable_monitor

Without these changes, osquery does not log directly to Syslog and default to filesystem /var/log/osquery. Rsyslog is setup to monitor this folder, however does not have permission to read osquery log files, resulting in Permission Denied errors in Syslog.

2022-08-12T12:27:24.360751+12:00 ip-10-4-220-246 rsyslogd: imfile: error accessing file '/var/log/osquery/osqueryd.results.log': Permission denied [v8.2112.0]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant