seph
unified_log
table? I don’t think there’s an osquery onen8felton
04/08/2022, 5:47 PMn8felton
04/08/2022, 5:50 PMosquery> select * from network_quality;
Error: no such table: network_quality
zwass
select * from unified_log where predicate='processImagePath contains "mdmclient"';
does return results?n8felton
04/08/2022, 6:12 PMzwass
zwass
n8felton
04/08/2022, 6:54 PMn8felton
04/08/2022, 7:04 PMsudo orbit shell
aDamn
05/06/2022, 3:11 AMallister
05/06/2022, 3:16 AMallister
05/06/2022, 3:17 AMclong
05/09/2022, 9:03 PMsudo /usr/local/bin/osqueryd --version
osqueryd version 4.9.0
sudo /usr/local/bin/osqueryi --version
osqueryi version 5.2.2
clong
05/09/2022, 9:04 PMnatewalck
05/09/2022, 9:09 PMnatewalck
05/09/2022, 9:09 PMls -lsa
on them both and see where i is linking toclong
05/09/2022, 9:11 PM0 lrwxr-xr-x 1 root wheel 58B May 9 14:00 osqueryctl -> /opt/osquery/lib/osquery.app/Contents/Resources/osqueryctl
78504 -rwxr-xr-x 1 root wheel 38M Jun 22 2021 osqueryd
0 lrwxr-xr-x 1 root wheel 52B May 9 14:00 osqueryi -> /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
clong
05/09/2022, 9:12 PMzwass
osqueryd
binary installed in in /usr/local/bin -- it just gets symlinked from the /opt/osquery/lib/osquery.app/
clong
05/09/2022, 9:13 PMzwass
clong
05/09/2022, 9:15 PMcom.facebook.osqueryd.plist
was touched on may 9 (so part of my install today), but im also seeing references to io.osquery.agent.plist
clong
05/09/2022, 9:16 PMGavin
05/09/2022, 9:51 PMallister
05/10/2022, 12:47 AMif [[ ! -h /usr/local/bin/osqueryd ]]; then
## remove in ~3 months because we should have caught all stragglers
/bin/rm /usr/local/bin/osqueryd
/bin/ln -s /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd /usr/local/bin/osqueryd
fi
allister
05/10/2022, 12:48 AMallister
05/10/2022, 2:25 AMallister
05/11/2022, 9:26 AMallister
05/11/2022, 9:28 AMMike Myers
05/11/2022, 3:25 PM