#OSQUERY WATCHDOG FULL#

#OSQUERY WATCHDOG FULL#

To see a full list of flags for your osquery version use -help or select from the osquery_flags table: $ osqueryi Google Flags enhances this to allow flags to be set within environment variables or via a 'master' flag file.

Essentially, any flag needed to help osquery determine and discover a configuration must be supplied via command-line arguments. Refer to the techniques below for obtaining ground truth and check other components of this Wiki.įlags that do not control startup settings may be included as 'options' within configuration. Warning, this list is still not the 'complete set' of flags. Most platform specific flags will control the OS API and library integrations used by osquery. Expect Linux, macOS, and Windows to include platform specific flags too. The shell contains a few more to help with printing and other helpful one-off modes of operation. Most flags apply to both tools, osqueryi and osqueryd. Understanding how flags work in osquery will help with stability and greatly reduce issue debugging time.

These flags are powered by Google Flags and are somewhat complicated. The osquery shell and daemon use optional command-line (CLI) flags to control initialization, disable/enable features, and select plugins.

Osquery watchdog