2

Can I have a non-auto load osquery plugin. i.e. A plugin executable which will start on it's own and not by osqueryd and still connect to osqueryd and register for a logger plugin? Or is it mandatory that osqueryd itself launches the plugin executable?

Baab
  • 179
  • 6

1 Answers1

1

Yes, you can absolutely do this. As long as the plugin is provided the correct path to the osquery extension socket, and has the appropriate permissions to open the socket, it can register at any time.

There is an example in the osquery-go readme.

Zach
  • 1,263
  • 11
  • 25
  • Adding on to what Zach says, you may up up wanting to set the osquery socket path. Or the default may be fine. – seph Feb 03 '23 at 03:58
  • But it appears that the indepenent extension is not getting loaded if it's entry is not sepcified in auto-load. – Baab Feb 03 '23 at 06:02