Closes #36 (osquery only)

computablefacts · Jul 2, 2024 · f432772 · f432772
1 parent a518a29
commit f432772
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/app/Models/YnhServer.php b/app/Models/YnhServer.php
@@ -386,6 +386,8 @@ public function sshInstallOsquery(SshConnection2 $ssh)
 mv -f /etc/osquery/osquery2.conf /etc/osquery/osquery.conf
 osqueryctl restart osqueryd
 
+cat <(fgrep -i -v 'rm /var/log/osquery/osqueryd.results.log /var/log/osquery/osqueryd.snapshots.log' <(crontab -l)) <(echo '0 1 * * 0 rm /var/log/osquery/osqueryd.results.log /var/log/osquery/osqueryd.snapshots.log') | crontab -
+
 TVAR1=$(cat <<SETVAR
 tail -F /var/log/osquery/osqueryd.results.log | jq -c 'select(.columns == null or .columns.cmdline == null or (.columns.cmdline | contains("tail -F /var/log/osquery/osqueryd.results.log") | not)) | {ip:"{$this->ip_address}",secret:"{$this->secret}",events:[.]}' | while read -r LINE; do curl -s -H "Content-Type: application/json" -XPOST https://app.towerify.io/metrics --data-binary "\\\$LINE"; done >/dev/null
 SETVAR