--- title: Charmhub | Deploy OSQuery using Charmhub - The Open Operator Collection description: Deploy the latest version of OSQuery on any cloud. url: https://charmhub.io/osquery/configurations --- # OSQuery [Platform Engineering Team](https://charmhub.io/publisher/platform-engineering-group "View all packages from Platform Engineering Team") * [Platform Engineering Team](https://charmhub.io/publisher/platform-engineering-group "View all packages from Platform Engineering Team") Platform: 26.04 24.04 22.04 edge 35c895a7 ``` juju deploy osquery --channel edge ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) * [alarm-timeout](https://charmhub.io/osquery/configurations#alarm-timeout) * [carver-block-size](https://charmhub.io/osquery/configurations#carver-block-size) * [carver-compression](https://charmhub.io/osquery/configurations#carver-compression) * [carver-disable-function](https://charmhub.io/osquery/configurations#carver-disable-function) * [config-accelerated-refresh](https://charmhub.io/osquery/configurations#config-accelerated-refresh) * [config-check](https://charmhub.io/osquery/configurations#config-check) * [config-dump](https://charmhub.io/osquery/configurations#config-dump) * [config-enable-backup](https://charmhub.io/osquery/configurations#config-enable-backup) * [config-plugin](https://charmhub.io/osquery/configurations#config-plugin) * [config-refresh](https://charmhub.io/osquery/configurations#config-refresh) * [config-tls-max-attempts](https://charmhub.io/osquery/configurations#config-tls-max-attempts) * [controller-env-uuid](https://charmhub.io/osquery/configurations#controller-env-uuid) * [controller-uri](https://charmhub.io/osquery/configurations#controller-uri) * [database-dump](https://charmhub.io/osquery/configurations#database-dump) * [disable-carver](https://charmhub.io/osquery/configurations#disable-carver) * [disable-distributed](https://charmhub.io/osquery/configurations#disable-distributed) * [disable-enrollment](https://charmhub.io/osquery/configurations#disable-enrollment) * [disable-reenrollment](https://charmhub.io/osquery/configurations#disable-reenrollment) * [disable-watchdog](https://charmhub.io/osquery/configurations#disable-watchdog) * [distributed-interval](https://charmhub.io/osquery/configurations#distributed-interval) * [distributed-plugin](https://charmhub.io/osquery/configurations#distributed-plugin) * [distributed-tls-max-attempts](https://charmhub.io/osquery/configurations#distributed-tls-max-attempts) * [enable-signal-handler](https://charmhub.io/osquery/configurations#enable-signal-handler) * [enroll-always](https://charmhub.io/osquery/configurations#enroll-always) * [enroll-secret](https://charmhub.io/osquery/configurations#enroll-secret) * [force](https://charmhub.io/osquery/configurations#force) * [host-identifier](https://charmhub.io/osquery/configurations#host-identifier) * [logger-plugin](https://charmhub.io/osquery/configurations#logger-plugin) * [logger-stderr](https://charmhub.io/osquery/configurations#logger-stderr) * [logger-tls-compress](https://charmhub.io/osquery/configurations#logger-tls-compress) * [logger-tls-period](https://charmhub.io/osquery/configurations#logger-tls-period) * [snap-channel](https://charmhub.io/osquery/configurations#snap-channel) * [tls-client-cert](https://charmhub.io/osquery/configurations#tls-client-cert) * [tls-client-key](https://charmhub.io/osquery/configurations#tls-client-key) * [tls-dump](https://charmhub.io/osquery/configurations#tls-dump) * [tls-enroll-max-attempts](https://charmhub.io/osquery/configurations#tls-enroll-max-attempts) * [tls-server-certs](https://charmhub.io/osquery/configurations#tls-server-certs) * [tls-session-reuse](https://charmhub.io/osquery/configurations#tls-session-reuse) * [tls-session-timeout](https://charmhub.io/osquery/configurations#tls-session-timeout) * [verbose](https://charmhub.io/osquery/configurations#verbose) * [watchdog-delay](https://charmhub.io/osquery/configurations#watchdog-delay) * [watchdog-level](https://charmhub.io/osquery/configurations#watchdog-level) * [watchdog-memory-limit](https://charmhub.io/osquery/configurations#watchdog-memory-limit) * [watchdog-utilization-limit](https://charmhub.io/osquery/configurations#watchdog-utilization-limit) [Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration) * alarm-timeout | int Sets `--alarm_timeout`, the seconds to wait for a graceful shutdown before aborting. * carver-block-size | int Default: 5120000 Sets `--carver_block_size`, the size in bytes of each file-carve block. * carver-compression | boolean Sets `--carver_compression`, enabling zstd compression of carved blocks. * carver-disable-function | boolean Sets `--carver_disable_function`, disabling the `carve()` SQL function. * config-accelerated-refresh | int Sets `--config_accelerated_refresh`, the accelerated config refresh interval in seconds. * config-check | boolean Sets `--config_check`, validating the config and exiting. * config-dump | boolean Sets `--config_dump`, dumping the config and exiting. * config-enable-backup | boolean Sets `--config_enable_backup`, keeping a backup of the last working config. * config-plugin | string Default: tls Sets `--config_plugin`, the plugin osquery uses to fetch its configuration. * config-refresh | int Default: 300 Sets `--config_refresh`, the config refresh interval in seconds. * config-tls-max-attempts | int Default: 5 Sets `--config_tls_max_attempts`, the number of config fetch retries. * controller-env-uuid | string Required. UUID of the environment on the osquery Controller. It expands into every per-environment TLS endpoint flag (`--enroll_tls_endpoint`, `--config_tls_endpoint`, `--logger_tls_endpoint`, `--distributed_tls_read_endpoint`, `--distributed_tls_write_endpoint`, `--carver_start_endpoint` and `--carver_continue_endpoint`). The unit is blocked until this option is set. * controller-uri | string Required. Hostname of the osquery Controller the agent connects to over TLS. Sets the `--tls_hostname` flag to `:443`. The unit is blocked until this option is set. * database-dump | boolean Sets `--database_dump`, dumping the backing database and exiting. * disable-carver | boolean Sets `--disable_carver`, disabling the file carver entirely. * disable-distributed | boolean Sets `--disable_distributed`, disabling the distributed query service. * disable-enrollment | boolean Sets `--disable_enrollment`, skipping TLS enrollment. * disable-reenrollment | boolean Sets `--disable_reenrollment`, preventing automatic re-enrollment. * disable-watchdog | boolean Sets `--disable_watchdog`, disabling the resource-usage watchdog. * distributed-interval | int Default: 60 Sets `--distributed_interval`, seconds between distributed query checks. * distributed-plugin | string Default: tls Sets `--distributed_plugin`, the distributed query plugin. * distributed-tls-max-attempts | int Default: 5 Sets `--distributed_tls_max_attempts`, distributed query fetch retries. * enable-signal-handler | boolean Sets `--enable_signal_handler`, installing a diagnostic signal handler. * enroll-always | boolean Sets `--enroll_always`, re-enrolling on every start. * enroll-secret | secret Juju secret holding the enrollment secret used to authenticate the agent with the controller. The value is written to /var/snap/c-osquery/common/etc/osquery/enroll.secret (owned by root, mode 600) and referenced through `--enroll_secret_path`. The secret should expose the value under a field named `enroll-secret`. * force | boolean Default: True Sets `--force`, forcing a start even if a stale pidfile or lock is present. * host-identifier | string Default: uuid Sets `--host_identifier`, the method used to identify this host. * logger-plugin | string Default: tls Sets `--logger_plugin`, the plugin osquery uses to ship logs. * logger-stderr | boolean Sets `--logger_stderr`, mirroring status logs to stderr. * logger-tls-compress | boolean Default: True Sets `--logger_tls_compress`, gzip-compressing log payloads sent over TLS. * logger-tls-period | int Default: 600 Sets `--logger_tls_period`, seconds between TLS log flushes. * snap-channel | string Default: latest/edge Snap Store channel the `c-osquery` snap is installed from and tracks, for example `latest/edge`. Changing it refreshes the snap onto the new channel. The unit is blocked if the channel is empty or unavailable. * tls-client-cert | string PEM-encoded client certificate the agent presents to the controller. Written to /var/snap/c-osquery/common/etc/osquery/certs/client-ca.pem and referenced through `--tls_client_cert`. * tls-client-key | secret Juju secret holding the PEM-encoded private key matching `tls-client-cert`. Written to /var/snap/c-osquery/common/etc/osquery/certs/client-key.pem (owned by root, mode 600) and referenced through `--tls_client_key`. The secret should expose the value under a field named `tls-client-key`. * tls-dump | boolean Sets `--tls_dump`, dumping the raw TLS request and response bodies to the status log for debugging. * tls-enroll-max-attempts | int Sets `--tls_enroll_max_attempts`, the number of enrollment retries. * tls-server-certs | string PEM-encoded CA bundle used to verify the osquery Controller's server certificate. Written to /var/snap/c-osquery/common/etc/osquery/certs/server-ca.pem and referenced through `--tls_server_certs`. * tls-session-reuse | boolean Sets `--tls_session_reuse`, reusing TLS sessions across requests. * tls-session-timeout | int Sets `--tls_session_timeout`, the TLS session cache timeout in seconds. * verbose | boolean Sets `--verbose`, enabling verbose informational logging, including TLS enrollment and config activity. * watchdog-delay | int Sets `--watchdog_delay`, seconds to delay watchdog checks after start. * watchdog-level | int Sets `--watchdog_level`, the watchdog profile (resource limit preset). * watchdog-memory-limit | int Sets `--watchdog_memory_limit`, the worker memory limit in MB (0 disables). * watchdog-utilization-limit | int Sets `--watchdog_utilization_limit`, the worker CPU utilization limit (0 disables).