Anyone using Humio or Splunk as the database collecting query results? Any pro-tips for a noob?

distributed queries are queries that are fanned out to all hosts and return results immediately

@clong if you don’t mind sharing the conf file for your FIM. I created the conf but for reason, my log file hasn’t been created. I’m wondering if I should have enabled the event disabled flag as false in the conf

they are either non-blocking sockets or connections that have failed

Hopefully a simple one is there a way to look for expired certs if you know the path that they live in

Hi all, I have a question, no sure if it’s possible currently - can osquery generically parse arbitrary sqlite databases, without having to write a separate extension for it?

when the osquery is installed by root,anybody can use it especially the low priv users,Can I do something that only the root use can use the osquery?

auditctl -s:

enabled 1
failure 0
pid 26628
rate_limit 0
backlog_limit 4096
lost 1
backlog 0
loginuid_immutable 0 unlocked

@fmanco Now that https://github.com/facebook/osquery/pull/5255 is landed, do you know when a new osquery version will be released?

What version are you using?

Thanks @thor Did you finally get a working build for 2008? Or just upgraded the servers? 😛

dose the osqueryd return the osuqery results interval as you define in the schedule? what's your meaning of "is it generally considered good practice to limit scheduled queries to return results only for the period since the last time the query ran"? @shed7

Hello, I test the extensions autoload according the docs and used example from

<https://github.com/osquery/osquery-python>

. I got the log like

Extension respawning too quickly: /path/to/my.ext

(verbose: "true")

Because if you've grabbed the LOCK, that might be why osqueryd isn't fully coming offlne

Anyone seen this in their logs? I've got it from every osquery installed.

killswitch.cpp:60] osquery::Killswitch::IsEnabledError 1 (Cannot call registry item: )

idk what you mean by “hang”

@fmanco what will it look like for someone outside FB to build osquery from source

@fmanco Will Facebook continue to cut releases as a function of when it deploys a new version osquery to its production systems? Or will you guys start deploying versions of osquery that aren't necessarily tied to the same releases available to the community?

@fmanco will it be possible to easily setup a system that builds a binary that has the same hash as the binary released upstream? (i'm talking about 100% reproducible builds)

@fmanco Will the community have any ability to see/review proposed changes from the FB team before they are merged to master?

ooh you pasted the code, where is my head! it's probably just to be able to access the file then

gotta love the

clowntown

label on osquery issues

I have osquery 3.2.6 deployed to hosts, and am not getting any results sent to a TLS endpoint for a large majority of the hosts. INFO log has

database.cpp:131] Resetting the database plugin: rocksdb

every 5 minutes across most.

@Prakhar Hi! Have you looked at the osquery_schedule table? it has a bunch of columns like wall_time, user_time, system_time and average_memory

the

--config_refresh

flag is only for the tls but not the filesystem plugin?

also sometimes Registry::call("config") in Config::genPack also returns empty responce

Do you have some sort of roadmap on when this code will be added and a release will be generated?

btw I just filed up a feature request, I hope they can bear with my CostaRican english 🙂 https://github.com/facebook/osquery/issues/5312

https://github.com/facebook/osquery/issues/5310 Has anyone encountered this question?

@groob really to the point of the errors. Where does one get support if an issue creation is inappropriate?