Where Does osquery Store Config and Packs?
osquery reads osquery.conf in /etc/osquery with query packs in packs beside it and results in the log dir.
Last updated
osquery configures from a JSON or YAML file in /etc/osquery. The osquery.conf file schedules queries and points at pack files in the packs folder. Flags in osquery.flags tune daemon behavior beside it.
Packs version with content, so pin them to releases you tested. Results flow to the configured logger rather than local files by default. Fleet managers overwrite these files, which makes hand edits temporary there.
Where osquery stores this, by platform
/etc/osquery/osquery.conf
Scheduled queries plus pack references live here. Packs sit in /etc/osquery/packs. Fleet managed hosts overwrite both on sync.
C:\Program Files\osquery\osquery.conf
Same config layout under the install folder. Packs sit in a packs subfolder beside it. Service manager restarts pick up edits.
Frequently asked questions
How do I add a scheduled query?
Add it to osquery.conf or a pack file it includes, then restart the daemon. Test the SQL with osqueryi first. Packs keep related queries together.
Where do osquery results go?
To the logger named in config, such as files, syslog, or TLS endpoints. Local file results land under the configured results path. Fleet setups centralize instead.
Notice an outdated path? Let us know.