velociraptor
velociraptor copied to clipboard
some issues with encrypted client logs on mac (tested on intel/arm64 macos14.4.1 and vrr0.72.1)
hmm,
I think there might be 2 issues:
-
by default the LaunchDaemon adds
--queit
- not sure how that interacts with the config flags ?https://github.com/Velocidex/velociraptor/blob/master/bin/installer_darwin.go#L146 for encrypted log file i.It would be good to check if that interacts with the feature ii. but also to add if possible an override to log level as a config flag (since editing daemon config after install and start is bit ... and I guess adding service install flags is probably less convenient for end user as opposed to a config flag but I could be wrong?) -
I'm actually not getting any output at all and the log file is not created when it runs as a daemon . i. even if Remove the
--quiet
from the daemon config, then stop unload reload the daemon and verify it's started without--quiet
the log file is not created. ii. As soon as i run it interactively with the same command line the log file is created. This makes me think perhaps something in the logging feature doesn't work when run as a daemon.