OptionsOn osqueryi itself
--flagfile
Line-delimited file of additional flags <path>
--D
Run as a daemon process
--S
Run as a shell process
--alarm_timeout
Seconds to allow for shutdown. Minimum is 10 <value>
--carver_block_size
Size of blocks used for POSTing data back to remote endpoints <value>
--carver_compression
Compress archives using zstd prior to upload (default false)
--carver_continue_endpoint
TLS/HTTPS endpoint that receives carved content after session creation <value>
--carver_disable_function
Disable the osquery file carver function (default true)
--carver_expiry
Seconds to store successful carve result metadata (in carves table) <value>
--carver_start_endpoint
TLS/HTTPS init endpoint for forensic carver <value>
--config_accelerated_refresh
Interval to wait if reading a configuration fails <value>
--config_check
Check the format of an osquery config and exit
--config_dump
Dump the contents of the configuration, then exit
--config_enable_backup
Backup config and use it when refresh fails
--config_path
Path to JSON config file <value>
--config_plugin
Config plugin name <value>
--config_refresh
Optional interval in seconds to re-read configuration <value>
--config_tls_endpoint
TLS/HTTPS endpoint for config retrieval <value>
--config_tls_max_attempts
Number of attempts to retry a TLS config request <value>
--daemonize
Attempt to daemonize (POSIX only)
--database_dump
Dump the contents of the backing store
--database_path
If using a disk-based backing store, specify a path <value>
--disable_carver
Disable the osquery file carver (default true)
--disable_enrollment
Disable enrollment functions on related config/logger plugins
--disable_extensions
Disable extension API
--disable_reenrollment
Disable re-enrollment attempts if related plugins return invalid
--disable_tables
Comma-delimited list of table names to be disabled <value>
--disable_watchdog
Disable userland watchdog process
--enable_extensions_watchdog
Enable userland watchdog for extensions processes
--enable_tables
Comma-delimited list of table names to be enabled <value>
--enroll_always
On startup, send a new enrollment request
--enroll_secret_env
Name of environment variable holding enrollment-auth secret <value>
--enroll_secret_path
Path to an optional client enrollment-auth secret <value>
--enroll_tls_endpoint
TLS/HTTPS endpoint for client enrollment <value>
--extensions_autoload
Optional path to a list of autoloaded & managed extensions <value>
--extensions_interval
Seconds delay between connectivity checks <value>
--extensions_require
Comma-separated list of required extensions <value>
--extensions_socket
Path to the extensions UNIX domain socket <value>
--extensions_timeout
Seconds to wait for autoloaded extensions <value>
--force
Force osqueryd to kill previously-running daemons
--install
Install osqueryd as a service
--logger_mode
Octal mode for log files (default '0640') <value>
--logger_plugin
Logger plugin name <value>
--logger_stderr
Write status logs to stderr
--logtostderr
Log messages to stderr in addition to the logger plugin(s)
--pidfile
Path to the daemon pidfile mutex <value>
--proxy_hostname
Optional HTTP proxy hostname <value>
--stderrthreshold
Stderr log level threshold <value>
--tls_client_cert
Optional path to a TLS client-auth PEM certificate <value>
--tls_client_key
Optional path to a TLS client-auth PEM private key <value>
--tls_enroll_max_attempts
The total number of attempts that will be made to the enroll endpoint if a request fails, 0 for infinite <value>
--tls_enroll_max_interval
Maximum wait time in seconds between enroll retry attempts <value>
--tls_hostname
TLS/HTTPS hostname for Config, Logger, and Enroll plugins <value>
--tls_server_certs
Optional path to a TLS server PEM certificate(s) bundle <value>
--tls_session_reuse
Reuse TLS session sockets
--tls_session_timeout
TLS session keep alive timeout in seconds <value>
--uninstall
Uninstall osqueryd as a service
--watchdog_delay
Initial delay in seconds before watchdog starts <value>
--watchdog_forced_shutdown_delay
Seconds that the watchdog will wait to do a forced shutdown after a graceful shutdown request, when a resource limit is hit <value>
--watchdog_latency_limit
Override watchdog profile CPU utilization latency limit <value>
--watchdog_level
Performance limit level <value>
--watchdog_memory_limit
Override watchdog profile memory limit (e.g., 300, for 300MB) <value>
--watchdog_utilization_limit
Override watchdog profile CPU utilization limit <value>
--audit_allow_config
Allow the audit publisher to change auditing configuration
--audit_allow_fim_events
Allow the audit publisher to install filesystem-related rules
--audit_allow_process_events
Allow the audit publisher to install process-related rules
--audit_allow_sockets
Allow the audit publisher to install socket-related rules
--audit_allow_user_events
Allow the audit publisher to install user-related rules
--augeas_lenses
Directory that contains augeas lenses files <value>
--aws_access_key_id
AWS access key ID <value>
--aws_debug
Enable AWS SDK debug logging
--aws_enable_proxy
Enable proxying of HTTP/HTTPS requests in AWS client config
--aws_firehose_endpoint
Custom Firehose endpoint <value>
--aws_firehose_period
Seconds between flushing logs to Firehose (default 10) <value>
--aws_firehose_stream
Name of Firehose stream for logging <value>
--aws_kinesis_disable_log_status
Disable status logs processing
--aws_kinesis_endpoint
Custom Kinesis endpoint <value>
--aws_kinesis_period
Seconds between flushing logs to Kinesis (default 10) <value>
--aws_kinesis_random_partition_key
Enable random kinesis partition keys
--aws_kinesis_stream
Name of Kinesis stream for logging <value>
--aws_profile_name
AWS profile for authentication and region configuration <value>
--aws_proxy_host
Proxy host for use in AWS client config <value>
--aws_proxy_password
Proxy password for use in AWS client config <value>
--aws_proxy_port
Proxy port for use in AWS client config <value>
--aws_proxy_scheme
Proxy HTTP scheme for use in AWS client config (http or https, default https) <value>
--aws_proxy_username
Proxy username for use in AWS client config <value>
--aws_region
AWS region <value>
--aws_secret_access_key
AWS secret access key <value>
--aws_session_token
AWS STS session token <value>
--aws_sts_arn_role
AWS STS ARN role <value>
--aws_sts_region
AWS STS region <value>
--aws_sts_session_name
AWS STS session name <value>
--aws_sts_timeout
AWS STS assume role credential validity in seconds (default 3600) <value>
--buffered_log_max
Maximum number of logs in buffered output plugins (0 = unlimited) <value>
--decorations_top_level
Add decorators as top level JSON objects
--disable_audit
Disable receiving events from the audit subsystem
--disable_caching
Disable scheduled query caching
--disable_database
Disable the persistent RocksDB storage
--disable_decorators
Disable log result decoration
--disable_distributed
Disable distributed queries (default true)
--disable_endpointsecurity
Disable receiving events from the EndpointSecurity subsystem
--disable_endpointsecurity_fim
Disable file events from the EndpointSecurity subsystem
--disable_events
Disable osquery publish/subscribe system
--disable_hash_cache
Cache calculated file hashes, re-calculate only if inode times change
--disable_logging
Disable ERROR/INFO logging
--distributed_interval
Seconds between polling for new queries (default 60) <value>
--distributed_loginfo
Log the running distributed queries name at INFO level
--distributed_plugin
Distributed plugin name <value>
--distributed_tls_max_attempts
Number of times to attempt a request <value>
--distributed_tls_read_endpoint
TLS/HTTPS endpoint for distributed query retrieval <value>
--distributed_tls_write_endpoint
TLS/HTTPS endpoint for distributed query results <value>
--docker_socket
Docker UNIX domain socket path <value>
--enable_file_events
Enables the file_events publisher
--enable_foreign
Enable no-op foreign virtual tables
--enable_keyboard_events
Enable listening for keyboard events
--enable_mouse_events
Enable listening for mouse events
--enable_numeric_monitoring
Enable numeric monitoring system
--ephemeral
Skip pidfile and database state checks
--es_fim_mute_path_literal
Comma delimited list of path literals to be muted for FIM <value>
--es_fim_mute_path_prefix
Comma delimited list of path prefxes to be muted for FIM <value>
--events_expiry
Timeout to expire event subscriber results <value>
--events_max
Maximum number of event batches per type to buffer <value>
--events_optimize
Optimize subscriber select queries (scheduler only)
--extensions_default_index
Enable INDEX on all extension table columns (default true)
--hash_cache_max
Size of LRU file hash cache <value>
--host_identifier
Field used to identify the host running osquery (hostname, uuid, instance, ephemeral, specified) <value>
--logger_event_type
Log scheduled results as events
--logger_kafka_acks
The number of acknowledgments the leader has to receive (0, 1, 'all') <value>
--logger_kafka_brokers
Bootstrap broker(s) as a comma-separated list of host or host:port (default port 9092) <value>
--logger_kafka_compression
Compression codec to use for compressing message sets ('none' or 'gzip') <value>
--logger_kafka_topic
Kafka topic to publish logs under <value>
--logger_min_status
Minimum level for status log recording <value>
--logger_min_stderr
Minimum level for statuses written to stderr <value>
--logger_numerics
Use numeric JSON syntax for numeric values
--logger_path
Directory path for ERROR/WARN/INFO and results logging <value>
--logger_rotate
Use filesystem log rotation
--logger_rotate_max_files
Max number of files to keep in rotation <value>
--logger_rotate_size
Size for each filesystem log in bytes <value>
--logger_snapshot_event_type
Log scheduled snapshot results as events
--logger_syslog_facility
Syslog facility for status and results logs (0-23, default 19) <value>
--logger_syslog_prepend_cee
Prepend @cee: tag to logged JSON messages
--logger_tls_compress
GZip compress TLS/HTTPS request body
--logger_tls_endpoint
TLS/HTTPS endpoint for results logging <value>
--logger_tls_max_lines
Max number of logs to send per period <value>
--logger_tls_max_linesize
Max size in bytes allowed per log line <value>
--logger_tls_period
Seconds between flushing logs over TLS/HTTPS <value>
--nullvalue
Set string for NULL values, default '' <value>
--numeric_monitoring_filesystem_path
File to dump numeric monitoring records one per line. The format of the line is <PATH><TAB><VALUE><TAB><TIMESTAMP> <value>
--numeric_monitoring_plugins
Comma separated numeric monitoring plugins names <value>
--numeric_monitoring_pre_aggregation_time
Time period in seconds for numeric monitoring pre-aggregation buffer <value>
--pack_delimiter
Delimiter for pack and query names <value>
--pack_refresh_interval
Cache expiration for a packs discovery queries <value>
--read_max
Maximum file read size <value>
--schedule_default_interval
Query interval to use if none is provided <value>
--schedule_epoch
Epoch for scheduled queries <value>
--schedule_lognames
Log the running scheduled query name at INFO level
--schedule_max_drift
Max time drift in seconds <value>
--schedule_reload
Interval in seconds to reload database arenas <value>
--schedule_splay_percent
Percent to splay config times <value>
--schedule_timeout
Limit the schedule to a duration in seconds, 0 for no limit <value>
--specified_identifier
Field used to specify the host_identifier when set to 'specified' <value>
--table_delay
Add an optional microsecond delay between table scans <value>
--table_exceptions
Allow tables to throw exceptions
--thrift_string_size_limit
Sets the maximum string size allowed in a thrift message, use 0 for unlimited <value>
--thrift_timeout
Timeout for thrift socket operations <value>
--thrift_verbose
Enable the thrift log handler
--tls_disable_status_log
Disable sending status logs
--verbose
Enable verbose informational messages
--worker_threads
Number of work dispatch threads <value>
--yara_delay
Time in ms to sleep after scan of each file (default 50) to reduce memory spikes <value>
--A
Select all from a table <value>
--connect
Connect to an extension socket <value>
--csv
Set output mode to 'csv'
--extension
Path to a single extension to autoload <value>
--header
Toggle column headers true/false
--json
Set output mode to 'json'
--json_pretty
Set output mode to 'json_pretty'
--line
Set output mode to 'line'
--list
Set output mode to 'list'
--pack
Run all queries in a pack <value>
--planner
Enable osquery runtime planner output
--profile
Enable profile mode when non-0, set number of iterations <value>
--separator
Set output field separator, default '|' <value>
