do not work
Opened this issue · 1 comments
Hello!Rules C:\Program Files\osquery\packs do not work.
C:\osquery>osqueryi.exe --flagfile=C:/osquery/osquery.flags --verbose
I1120 12:34:51.873805 4364 init.cpp:413] osquery initialized [version=5.10.2]
I1120 12:34:51.891528 4364 dispatcher.cpp:78] Adding new service: UsersService (00000217DCF31520) to thread: 1404 (00000217DCF6DBC0) in process 5660
I1120 12:34:51.905087 4364 dispatcher.cpp:78] Adding new service: GroupsService (00000217DCF31630) to thread: 3864 (00000217DCECC480) in process 5660
I1120 12:34:51.905087 4364 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: \Program Files\osquery\extensions.load
I1120 12:34:51.920759 4364 dispatcher.cpp:78] Adding new service: ExtensionWatcher (00000217DCE9E530) to thread: 5336 (00000217DCECC180) in process 5660
I1120 12:34:51.936823 4364 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (00000217DEB7E4C0) to thread: 6228 (00000217DEB85B20) in process 5660
I1120 12:34:51.936823 6228 interface.cpp:299] Extension manager service starting: \.\pipe\shell.em
I1120 12:34:51.936823 4364 auto_constructed_tables.cpp:99] Removing stale ATC entries
I1120 12:34:51.952489 3864 groups_service.cpp:55] Groups cache initialized
I1120 12:34:51.984232 1404 users_service.cpp:149] Users cache initialized
E1120 12:34:52.398033 4364 config.cpp:879] updateSource failed to parse config, of source: C://osquery//osquery.conf and content: {
the osqueryd.INFO log is written, but the warning log is missing