Channels
  • r

    Ryan

    1 year ago
    Hi all, I just upgraded to latest Fleet 3.6.0 and I wanted to enquire about the Osquery Options page (
    /admin/osquery
    ) (screenshot on the thread).
    this is the default value:
    We’re already configuring osquery flags via Ansible when we roll out osquery, so what happens in this situation, will Fleet try to override?
    If these options take precedence what happens if we change one of them in the config file on a host (
    /etc/osquery/osquery.flags)
    ?
  • zwass

    zwass

    1 year ago
    These do take precedence as they are loaded after the flag file. Please note that we did not change how this works, only added the editor in the UI. This is the same config you could edit previously with fleetctl.
  • r

    Ryan

    1 year ago
    Ok cool, thanks!
    Do they take immediate effect, or does osquery need a restart?
  • zwass

    zwass

    1 year ago
    osquery checks in for configs on a configurable interval (
    config_refresh
    ) and the configs will take effect immediately after it receives the new config (assuming they are not startup-only options).