Anyway, osqueryd and osqueryi are actually the same binary. If you rename the file to osqueryi, it will behave like you want

I can help in #kolide @nNipsx

@Kemal It would be helpful if you could elaborate on what exactly you are looking for in regards to this table

Secondly, there's more than one source of information for osquery. There's readthedocs, there's the fucking osqueryi shell on your box, and there's also this Slack, which you take thorough advantage of. Lastly, you might wanna look into a new keyboard, as your caps lock key appears to be faulty.

İ think you should be more calm. Or if you wish, you can remove me from the channels

What about use of logo in presentations, etc? Any issues?

@Mustafa sorry for the delays, most people in this slack are PST 😉 As for the question about authenticode, try handing it a SQL glob -

C:\ProcessExplorer\%

We have a petition open to get a new StackOverflow community for osquery! Please go follow the status of it here: https://area51.stackexchange.com/proposals/117450/osquery?referrer=4vQ1XXXw4Lv-xaQUbWVSkA2

good to know. I asked because last year I wrote an HIDS for my company using eBPF extremely. But I don't have time anymore to maintain it.

The use case for supporting this build flow is OS package management. But I have no pointers to help guide you other than the FreeBSD osquery port.

Is the list of community articles still being maintained on the osquery site? I think our company's blog posts used to be here, but no longer? https://osquery.io/blog/community-articles

Hi, how can I forward logs generated by osqueryd to Splunk using 'http event collector'. I'm aware of using splunk universal forwarder which can be configured to read logs from file and forward to splunk server. But I'm interested in using http event collector to send logs to splunk . Any pointers ?

Hi, is there any option for log rotation for osquery's result logs ? If yes, please share the doc link. Thanks

@Raff_B do you have an example query that's leaking memory? I just ran leaks on it and it didn't show anything

Hello all, I was wondering in the Osquery.conf when you refer to the packs you want to use, in the packs section. Does this automatically add those queries to the deamon. Or do queries NEED to be explicitly written in the osquery.conf to be executed by the daemon.

anything else needed in order to get https://github.com/facebook/osquery/pull/4255 merged?

@coffee only a few thousand of them 🙂

is there anyway to check if windows machine have a virus scanner running and if bitlocker is enabled?

I'm not sure if this an issue that belongs on github or more of a question, so I'm starting here. I'm seeing this issue where over time, osquery will start to utilize a lot of CPU. We have observed that when this happens, it is typically after osquery has been running for several months. We also observe that when this happens, there are 50k+ sst files under /var/osquery/osquery.db! Couple of questions: - Is it normal to have so many files under there? - Is it safe to purge old files based on mtime? or atime? - Has anyone else observed so many files and/or a high spike in CPU after running for several months? osquery info:

osquery_version = 2.8.0
     os_version = 14.04, Trusty Tahr
       os_build =
    os_platform = ubuntu

some bash showing the files and that they're all accessed within the last few days (this is on a host that is not yet observing the high CPU, but sure has a lot of sst files): https://pastebin.com/pvaxwdPm

Hey there, I was wondering - did anyone ever considered GDPR regulations on osquery data? I understand it is possible to hash fields/columns in a query, which is very helpful, yet some columns may consist pii in very specific cases (e.g. windows_events might contain the username?), does anyone have any idea how to approach this issue?

AMD invented 64-bit (AMD64), Intel copied it (EM64T) and everyone ended up using x86_64 as a “generic” term 😄

is Osquery able to read a file content and send them as logs?

i don’t see any table for print server events. I think that the only way is to configure the related audit settings in windows server and achive the logs using windows_event osquery table, right?

What happens if you launch an osqueryd, with a scheduled query? Would you get it nowish?

From the vendor, something like https://support.apple.com/en-us/HT201222 but machine readable.

Bumping this.

@thor @theopolis all the queries in this pack are somewhat broken. they should be

SELECT * FROM users CROSS JOIN

is there an easy way to tell osqueryd to flush it’s database? i’m trying to reset the baseline it’s using for differentials

Hi! My osquery_results file gets 4 identical lines for events generated by FIM, does that ring any bells to anyone ?