Hello there is no count change in the log results generated

Question

Hello there is no count change in the log results generated after the osquery difference query does it mean that the log results are not stored in RocksDB Why does this happen

Mike Myers · Answer

Hi demonbhao It could mean that the event source you selected is not active enabled or that it failed to initialize for some reason I think we really need more info Maybe you can run `osqueryi verbose` and provide the ` disable events=false config path= path to your osqueryd osquery conf flagfile= path to your osqueryd osquery flags`

Mike Myers · Answer

Also the answer might be something in your conf or flags if you can share those

demonbhao · Answer

Hi I didn t set the contents of the conf file on each osquery machine but the contents of the flags file are shown below

demonbhao · Answer

My conf files are all All the policies I send to osquery are based on Fleet Pack and the options in Fleet UI set the contents of the osquery conf file Fleet UI options spec config options utc true audit persist true database path var osquery osquery db disable audit false logger plugin tls logger stderr false config refresh 300 disable events false pack delimiter schedule epoch 1 logger event type false logger min status 2 logger min stderr 2 logger tls period 3 audit allow config true distributed plugin tls audit allow sockets true disable distributed false logger tls endpoint api v1 osquery log distributed interval 30 logger tls max linesize 10485760 audit allow process events true distributed tls max attempts 3 decorators load SELECT uuid AS host uuid FROM system info SELECT hostname AS hostname FROM system info file paths etc etc passwd etc shadow etc rc local etc cron d usr usr bin top usr bin ps usr bin ls usr bin netstat var var spool cron var www overrides

demonbhao · Answer

`osqueryi verbose`