velociraptor icon indicating copy to clipboard operation
velociraptor copied to clipboard

some issues with encrypted client logs on mac (tested on intel/arm64 macos14.4.1 and vrr0.72.1)

Open awx-vsyr opened this issue 9 months ago • 0 comments

hmm,

I think there might be 2 issues:

  1. by default the LaunchDaemon adds --queit - not sure how that interacts with the config flags ?https://github.com/Velocidex/velociraptor/blob/master/bin/installer_darwin.go#L146 for encrypted log file i.It would be good to check if that interacts with the feature ii. but also to add if possible an override to log level as a config flag (since editing daemon config after install and start is bit ... and I guess adding service install flags is probably less convenient for end user as opposed to a config flag but I could be wrong?)

  2. I'm actually not getting any output at all and the log file is not created when it runs as a daemon . i. even if Remove the --quiet from the daemon config, then stop unload reload the daemon and verify it's started without --quiet the log file is not created. ii. As soon as i run it interactively with the same command line the log file is created. This makes me think perhaps something in the logging feature doesn't work when run as a daemon.

awx-vsyr avatar May 13 '24 23:05 awx-vsyr