Search code examples
osquery

A non-auto load osquery logger plug-in


Can I have a non-auto load osquery plugin. i.e. A plugin executable which will start on it's own and not by osqueryd and still connect to osqueryd and register for a logger plugin? Or is it mandatory that osqueryd itself launches the plugin executable?


Solution

  • Yes, you can absolutely do this. As long as the plugin is provided the correct path to the osquery extension socket, and has the appropriate permissions to open the socket, it can register at any time.

    There is an example in the osquery-go readme.