Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Update outdated Orbit and osquery logging documentation (#9064)

Browse Source 
* Update some outdated Orbit and osquery logs

* Revert index change
This commit is contained in:
Lucas Manuel Rodriguez
2023-01-04 08:46:28 -03:00
committed by GitHub
parent cb230a8291
commit a506a8e66b
3 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Using-Fleet/FAQ.md
+7 -4
View File
@@ -106,15 +106,18 @@ Live query results (executed in the web UI or `fleetctl query`) are pushed direc
### Scheduled queries
Scheduled query results (queries that are scheduled to run in Packs) are typically sent to the Fleet server, and will be available on the filesystem of the server at the path configurable by [`--osquery_result_log_file`](https://fleetdm.com/docs/deploying/configuration#osquery-result-log-file). This defaults to `/tmp/osquery_result`.
It is possible to configure osqueryd to log query results outside of Fleet. For results to go to Fleet, the `--logger_plugin` flag must be set to `tls`.
Scheduled query results (queries that are scheduled to run individually or in Packs) from enrolled hosts can be logged by Fleet.
For results to go to Fleet, the osquery `--logger_plugin` flag must be set to `tls`.
### What are my options for storing the osquery logs?
Folks typically use Fleet to ship logs to data aggregation systems like Splunk, the ELK stack, and Graylog.
The [logger configuration options](https://fleetdm.com/docs/deploying/configuration#osquery-status-log-plugin) allow you to select the log output plugin. Using the log outputs you can route the logs to your chosen aggregation system.
Fleet supports multiple logging destinations for scheduled query results and status logs. The `--osquery_result_log_plugin` and `--osquery_status_log_plugin` can be set to:
`filesystem`, `firehose`, `kinesis`, `lambda`, `pubsub`, `kafkarest`, and `stdout`.
See:
- https://fleetdm.com/docs/deploying/configuration#osquery-result-log-plugin.
- https://fleetdm.com/docs/deploying/configuration#osquery-status-log-plugin.
### Troubleshooting