diff --git a/ESXi/ansible/roles/logger/tasks/main.yml b/ESXi/ansible/roles/logger/tasks/main.yml index 7b5a613..55d6434 100644 --- a/ESXi/ansible/roles/logger/tasks/main.yml +++ b/ESXi/ansible/roles/logger/tasks/main.yml @@ -340,8 +340,11 @@ sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml + # Don't log osquery INFO messages + # Fix snapshot event formatting fleetctl get options > /tmp/options.yaml /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1' + /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_snapshot_event_type' '2' fleetctl apply -f /tmp/options.yaml # Use fleetctl to import YAML files diff --git a/ESXi/main.tf b/ESXi/main.tf index ca911ab..1b0d673 100644 --- a/ESXi/main.tf +++ b/ESXi/main.tf @@ -72,7 +72,7 @@ resource "esxi_guest" "dc" { boot_disk_type = "thin" boot_disk_size = "35" - memsize = "2048" + memsize = "4096" numvcpus = "2" resource_pool_name = "/" power = "on" diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 35ccaed..c67330c 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -267,8 +267,10 @@ import_osquery_config_into_fleet() { sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml # Don't log osquery INFO messages + # Fix snapshot event formatting fleetctl get options > /tmp/options.yaml /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1' + /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_snapshot_event_type' '2' fleetctl apply -f /tmp/options.yaml # Use fleetctl to import YAML files diff --git a/Vagrant/scripts/install-osquery.ps1 b/Vagrant/scripts/install-osquery.ps1 index e5ffec3..0cd42a7 100755 --- a/Vagrant/scripts/install-osquery.ps1 +++ b/Vagrant/scripts/install-osquery.ps1 @@ -26,6 +26,8 @@ If (-not ($service)) { (Get-Content "c:\Program Files\osquery\osquery.flags") -replace 'path\\to\\file\\containing\\secret.txt', 'Program Files\osquery\kolide_secret.txt' | Set-Content "c:\Program Files\osquery\osquery.flags" ## Change path to certfile (Get-Content "c:\Program Files\osquery\osquery.flags") -replace 'c:\\ProgramData\\osquery\\certfile.crt', 'c:\Program Files\osquery\certfile.crt' | Set-Content "c:\Program Files\osquery\osquery.flags" + ## Remove the verbose flag and replace it with the logger_min_status=1 option (See https://github.com/osquery/osquery/issues/5212) + (Get-Content "c:\Program Files\osquery\osquery.flags") -replace '--verbose=true', '--logger_min_status=1' | Set-Content "c:\Program Files\osquery\osquery.flags" ## Add certfile.crt Copy-Item "c:\vagrant\resources\fleet\server.crt" "c:\Program Files\osquery\certfile.crt" ## Start the service