https://github.com/osquery/osquery logo
Title
f

Feafanov Veniamin Vasilevich

05/17/2023, 5:37 PM
Hi everyone! Hypothetically, if I wanted to run osquery on top of MySQL (or any other database system besides SQLite), would that be a feasible thing to achieve? I'm not extensively familiar with osquery's architecture, I had assumed that the module that gets raw data from the operating system would be fairly easy to separate from the SQLite syntax layered on top, but now I'm not so sure. If my misconceptions cannot be corrected with only a few words, please feel free to direct me to documentation or part of the source code that could help me understand the matter better. Thank you in advance!
j

John Speno

05/17/2023, 6:43 PM
Are you asking if there is a way to configure osquery to use MySQL as its database?
Reading this might give you some insights as to why that kind of question has confused me. https://osquery.readthedocs.io/en/stable/introduction/sql/
f

Feafanov Veniamin Vasilevich

05/17/2023, 6:53 PM
@John Speno yeah that's basically what I was asking. So if I'm reading this right, osquery doesn't actually "use" SQLite, it only uses SQLite's SQL syntax for queries and generates and passes data on the fly, while using RocksDB for some utility storage. So I figure my question doesn't make sense in the first place
j

John Speno

05/17/2023, 6:54 PM
Yes, that's right.
f

Feafanov Veniamin Vasilevich

05/17/2023, 6:55 PM
Alright, thanks a lot for the heads up!
z

zwass

05/17/2023, 7:58 PM
Y'all have it right. Just to add a bit, in theory you could perhaps use the generation functions in the osquery codebase with the Postgres "Foreign Data Wrapper" feature (somewhat equivalent to the "virtual tables" feature osquery uses in SQLite). But it's not clear what the benefit would be.
s

seph

05/19/2023, 11:14 AM
Osquery does use SQLite. But it’s not a app-db usage. Instead osquery is uses the SQLite library as to provide the sql engine.