or they are just grabbing and concatenating major + minor + patch actually now I look at that again, so I'm guessing they are doing

var OS=major+.+minor+.+patch

to describe in pseudocode

Perhaps some platform specific logic may be needed for Ubuntu to grab version and then substr anything to the left of LTS

I didn’t realize there was a separate channel just for Linux, so I’m cross-posting my question here

Is there a good way to tell whether a process is part of a container (independent of the runtime, I know docker containers could be found with

docker_containers

table)? Not sure if @Artemis Tosini’s cgroup work will help with this. In current osquery, best I've come up with is

select * from processes join process_namespaces using (pid) where cgroup_namespace != (select cgroup_namespace from process_namespaces where pid = 1);

(eg. check for a different cgroup than the init process), though I think this will pick up other processes using cgroups besides just containers. I'm looking to do this in order to take advantage of the

pid_with_namespace

column @Stefano Bonicatti added to some tables.

Trying to dig back into the history of when the linux osqueryd binary increased in size.... Anyone recall why it increased so dramatically from

4.9

44mb ------>

5.0

196mb ?

I'm looking at adding some containerd tables. Unfortunately the API is via grpc so we'd require grpc as a dependancy and either pregenerate the C++ with protoc or use protoc at build time, does anyone have opinions?

Can anyone please help me with scheduled queries for docker and Linux environment for improving incident detection and response program.

Hello 🖖 I followed the docs after the deployment of the fleet server. generated the deb package. but was not able to run it .. Am I missing something ? OH tried with dpkg same issue

mchorfa@mchorfa-linux-02:~/tmp$ sudo apt install fleet-osquery_1.3.0_amd64.deb
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package fleet-osquery_1.3.0_amd64.deb

Hello. I'm trying to package osquery for my distribution of choice. I'm running into a lot of trouble getting the build to find system augeas, is there some flag I need to be passing to get the build to find system libraries?

@Larry Gryziak has left the channel

This message was deleted.