Hello I m trying to collect user based events specifically f

Question

Hello I m trying to collect user based events specifically failed login attempts My user events table is empty and I see this when I query the table Table user events is event based but events are disabled How do I enable events for this table

alessandrogario · Answer

disable events=false disable audit=false audit allow config=true audit persist=true audit allow user events=true verbose and systemctl disable auditd

Jeff Singleton · Answer

I have all of that in my flag file Let me verify that auditd is disabled

Jeff Singleton · Answer

Does it matter what order the flags are in

alessandrogario · Answer

Flag order is not important

alessandrogario · Answer

auditd will cause issues if it s running

alessandrogario · Answer

verbose should show what the issue is

Jeff Singleton · Answer

It is disabled Adding verbose

alessandrogario · Answer

It is also possible that no events are being generated for that table You can temporarily turn process events on audit allow process events=true to see if the audit publisher is working correctly

Jeff Singleton · Answer

Hmm I already had that as well I see this error when starting osqueryd Error registering subscriber process file events Subscriber disabled via configuration

alessandrogario · Answer

That table is disabled by default it s just a warning

alessandrogario · Answer

and can be safely ignored

Jeff Singleton · Answer

Ok

Jeff Singleton · Answer

Is this what I am looking for Starting event publisher run loop auditeventpublisher

alessandrogario · Answer

yes

alessandrogario · Answer

Is there no other error printed

alessandrogario · Answer

is the process events table working

Jeff Singleton · Answer

I see this Enabling audit rules for the process events execve execveat table

Jeff Singleton · Answer

No other errors

alessandrogario · Answer

ok so it seems like the audit publisher is working correctly

alessandrogario · Answer

can you run a SELECT FROM process events query

alessandrogario · Answer

I haven t used user events much but seem to recall that it should always record logins to the TTY

alessandrogario · Answer

maybe on SSH too

Jeff Singleton · Answer

Table process events is event based but events are disabled

alessandrogario · Answer

Has the disable events=false flag been passed

Jeff Singleton · Answer

yes that is in my flag file

alessandrogario · Answer

Has osquery been restarted

Jeff Singleton · Answer

Yes I have restarted after each change

alessandrogario · Answer

or it is possible that the flagfile is not being correctly loaded

alessandrogario · Answer

you can pass the path to it using flagfile= path to file

alessandrogario · Answer

I think the default path is ` etc osquery osquery flags default`

Jeff Singleton · Answer

I m running this on the command line in two windows One has osqueryd flagfile etc osquery osquery flag and the other is running osqueryi

alessandrogario · Answer

osqueryi does not communicate with osqueryd

alessandrogario · Answer

osqueryi is osqueryd running in interactive mode

Jeff Singleton · Answer

Got that

alessandrogario · Answer

so if you run `osqueryi flagfile etc osquery osquery flag` you should in theory be able to query user events and process events

alessandrogario · Answer

osqueryd must be closed otherwise it will attempt to steal the audit ownership from osqueryi

Jeff Singleton · Answer

Oh man I think because I didn t fully understand that I figured it out I actually didn t have disable events=false and now I do and its working

Jeff Singleton · Answer

I guess it just takes going through it line by line

alessandrogario · Answer

Nice smile if you have any issue we are here to help slightly smiling face

Jeff Singleton · Answer

Thank you