OSQuery

Learn about configurations >

• alarm-timeout | int

  Sets --alarm_timeout, the seconds to wait for a graceful shutdown before aborting.

• carver-block-size | int

  Default: 5120000

  Sets --carver_block_size, the size in bytes of each file-carve block.

• carver-compression | boolean

  Sets --carver_compression, enabling zstd compression of carved blocks.

• carver-disable-function | boolean

  Sets --carver_disable_function, disabling the carve() SQL function.

• config-accelerated-refresh | int

  Sets --config_accelerated_refresh, the accelerated config refresh interval in seconds.

• config-check | boolean

  Sets --config_check, validating the config and exiting.

• config-dump | boolean

  Sets --config_dump, dumping the config and exiting.

• config-enable-backup | boolean

  Sets --config_enable_backup, keeping a backup of the last working config.

• config-plugin | string

  Default: tls

  Sets --config_plugin, the plugin osquery uses to fetch its configuration.

• config-refresh | int

  Default: 300

  Sets --config_refresh, the config refresh interval in seconds.

• config-tls-max-attempts | int

  Default: 5

  Sets --config_tls_max_attempts, the number of config fetch retries.

• controller-env-uuid | string

  Required. UUID of the environment on the osquery Controller. It expands into every per-environment TLS endpoint flag (--enroll_tls_endpoint, --config_tls_endpoint, --logger_tls_endpoint, --distributed_tls_read_endpoint, --distributed_tls_write_endpoint, --carver_start_endpoint and --carver_continue_endpoint). The unit is blocked until this option is set.

• controller-uri | string

  Required. Hostname of the osquery Controller the agent connects to over TLS. Sets the --tls_hostname flag to <controller-uri>:443. The unit is blocked until this option is set.

• database-dump | boolean

  Sets --database_dump, dumping the backing database and exiting.

• disable-carver | boolean

  Sets --disable_carver, disabling the file carver entirely.

• disable-distributed | boolean

  Sets --disable_distributed, disabling the distributed query service.

• disable-enrollment | boolean

  Sets --disable_enrollment, skipping TLS enrollment.

• disable-reenrollment | boolean

  Sets --disable_reenrollment, preventing automatic re-enrollment.

• disable-watchdog | boolean

  Sets --disable_watchdog, disabling the resource-usage watchdog.

• distributed-interval | int

  Default: 60

  Sets --distributed_interval, seconds between distributed query checks.

• distributed-plugin | string

  Default: tls

  Sets --distributed_plugin, the distributed query plugin.

• distributed-tls-max-attempts | int

  Default: 5

  Sets --distributed_tls_max_attempts, distributed query fetch retries.

• enable-signal-handler | boolean

  Sets --enable_signal_handler, installing a diagnostic signal handler.

• enroll-always | boolean

  Sets --enroll_always, re-enrolling on every start.

• enroll-secret | secret

  Juju secret holding the enrollment secret used to authenticate the agent with the controller. The value is written to /var/snap/c-osquery/common/etc/osquery/enroll.secret (owned by root, mode 600) and referenced through --enroll_secret_path. The secret should expose the value under a field named enroll-secret.

• force | boolean

  Default: True

  Sets --force, forcing a start even if a stale pidfile or lock is present.

• host-identifier | string

  Default: uuid

  Sets --host_identifier, the method used to identify this host.

• logger-plugin | string

  Default: tls

  Sets --logger_plugin, the plugin osquery uses to ship logs.

• logger-stderr | boolean

  Sets --logger_stderr, mirroring status logs to stderr.

• logger-tls-compress | boolean

  Default: True

  Sets --logger_tls_compress, gzip-compressing log payloads sent over TLS.

• logger-tls-period | int

  Default: 600

  Sets --logger_tls_period, seconds between TLS log flushes.

• snap-channel | string

  Default: latest/edge

  Snap Store channel the c-osquery snap is installed from and tracks, for example latest/edge. Changing it refreshes the snap onto the new channel. The unit is blocked if the channel is empty or unavailable.

• tls-client-cert | string

  PEM-encoded client certificate the agent presents to the controller. Written to /var/snap/c-osquery/common/etc/osquery/certs/client-ca.pem and referenced through --tls_client_cert.

• tls-client-key | secret

  Juju secret holding the PEM-encoded private key matching tls-client-cert. Written to /var/snap/c-osquery/common/etc/osquery/certs/client-key.pem (owned by root, mode 600) and referenced through --tls_client_key. The secret should expose the value under a field named tls-client-key.

• tls-dump | boolean

  Sets --tls_dump, dumping the raw TLS request and response bodies to the status log for debugging.

• tls-enroll-max-attempts | int

  Sets --tls_enroll_max_attempts, the number of enrollment retries.

• tls-server-certs | string

  PEM-encoded CA bundle used to verify the osquery Controller's server certificate. Written to /var/snap/c-osquery/common/etc/osquery/certs/server-ca.pem and referenced through --tls_server_certs.

• tls-session-reuse | boolean

  Sets --tls_session_reuse, reusing TLS sessions across requests.

• tls-session-timeout | int

  Sets --tls_session_timeout, the TLS session cache timeout in seconds.

• verbose | boolean

  Sets --verbose, enabling verbose informational logging, including TLS enrollment and config activity.

• watchdog-delay | int

  Sets --watchdog_delay, seconds to delay watchdog checks after start.

• watchdog-level | int

  Sets --watchdog_level, the watchdog profile (resource limit preset).

• watchdog-memory-limit | int

  Sets --watchdog_memory_limit, the worker memory limit in MB (0 disables).

• watchdog-utilization-limit | int

  Sets --watchdog_utilization_limit, the worker CPU utilization limit (0 disables).