Skip to content

Add flag to increase read_max in osquery to 1GB #1050

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
javuto merged 1 commit into from
Sep 10, 2026
+15 −0
Merged

Add flag to increase read_max in osquery to 1GB #1050

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions pkg/environments/flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,16 @@ import (
const (
// CarverBlockSizeValue to configure size in bytes for carver blocks
CarverBlockSizeValue string = "5120000"
// ReadMaxValue to configure the read_max value for osquery, 1GB = 1073741824 bytes
ReadMaxValue string = "1073741824"
// FlagGenericValue to use as generator for generic flags
FlagGenericValue string = `--{{ .FlagName }}={{ .FlagValue }}`
// FlagTLSServerCerts for the --tls_server_certs flag
FlagNameTLSServerCerts string = `tls_server_certs`
// FlagCarverBlockSize for the --carver_block_size flag
FlagNameCarverBlockSize string = `carver_block_size`
// FlagReadMax to use as generator for the --read_max flag
FlagReadMax string = `read_max`
// FlagsConfigPlugin to configure the config plugin
FlagsConfigPlugin string = `
--config_plugin=tls
Expand Down Expand Up @@ -53,6 +57,7 @@ const (
--host_identifier=uuid
--force=true
--utc=true
{{ .FlagReadMaxValue }}
--enroll_secret_path={{ .SecretFile }}
--enroll_tls_endpoint=/{{ .Environment.UUID }}/{{ .Environment.EnrollPath }}
{{ .FlagsConfigPlugin }}
Expand Down Expand Up @@ -80,6 +85,7 @@ type flagData struct {
FlagsCarverPlugin string
FlagServerCerts string
FlagCarverBlock string
FlagReadMaxValue string
}

// GenServerCertsFlag to generate the --tls_server_certs flag
Expand All @@ -98,6 +104,14 @@ func GenCarveBlockSizeFlag(blockSize string) string {
return GenSingleFlag("blocksize", FlagNameCarverBlockSize, blockSize)
}

// GenReadMaxFlag to generate the --read_max flag
func GenReadMaxFlag(readMax string) string {
if readMax == "" {
return ""
}
return GenSingleFlag("readmax", FlagReadMax, readMax)
}

// GenSingleFlag to generate a generic flag to be used by osquery
func GenSingleFlag(tmplName, flagName, flagValue string) string {
data := struct {
Expand Down Expand Up @@ -191,6 +205,7 @@ func (environment *EnvManager) GenerateFlags(env TLSEnvironment, secretPath, cer
FlagsQueryPlugin: queryFlags,
FlagsCarverPlugin: carverFlags,
FlagServerCerts: flagServerCerts,
FlagReadMaxValue: GenReadMaxFlag(ReadMaxValue),
}
return ParseFlagTemplate("flags", FlagsTemplate, data), nil
}
Expand Down
Loading