Hi all I need some helps on getting logger plugin working I

Question

Hi all I need some helps on getting logger plugin working I tried <https github com osquery osquery python blob master examples foobar logger ext> using command python foobar logger ext socket pipe osquery em to attach osqueryd but nothing was logged Thx

theopolis · Answer

Hi Tao how are you starting the osquery process osquery will have to know what logger plugin you want to use for example with ` logger plugin foobar logger`

Tao Jiang · Answer

Does that mean logger plugin works differently than table plugin For table plugin I can attach to osqueryd later I had thought I can do the same as logger plugin

Tao Jiang · Answer

Our osqueryd is configured as windows service `sc exe create osqueryd type= own start= auto error= normal binpath= E osquery osqueryd osqueryd exe flagfile=E osquery osquery flags ` `displayname= osqueryd ` `sc exe start osqueryd`

Tao Jiang · Answer

Since we are primarily running with osqueryd we have to update osquery conf file by adding foobar logger Also update osquery flags by add extensions timeout=600 extensions require=foobar logger to let osqueryd enough time to wait for logger to start because logger cannot start attach to socket until osqueryd started This is quite awkward process

Tao Jiang · Answer

If logger plugin can work the same way as table plugin even need to use ExtensionClient to activate the logger it will be much better and robust approach

theopolis · Answer

Instead of launching the extension separately use the auto load feature <https osquery readthedocs io en latest deployment extensions |https osquery readthedocs io en latest deployment extensions >

theopolis · Answer

With auto loading you should be able to keep the default timeout

Tao Jiang · Answer

Thanks However there are a few concerns on this approach 1 what if extension crashes this only option will be restarting osquery 2 we d like to use osquery as universal data collection agent and pass data to downstream components for some processing before data shipping to cloud It will be hard to model the downstream component as a logger

Tao Jiang · Answer

I found tls config logger could be much better alternative <https github com osquery osquery issues 940>