Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

log file has this in it:
```
Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg
I0706 11:43:28.250113  8595 events.cpp:825] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration
I0706 11:43:28.250262  8595 events.cpp:825] Event publisher not enabled: syslog: Publisher disabled via configuration
I0706 11:43:28.250396  8595 events.cpp:1079] Error registering subscriber: process_file_events: Subscriber disabled via configuration
I0706 11:43:28.250416  8595 events.cpp:1079] Error registering subscriber: socket_events: Subscriber disabled via configuration
I0706 11:43:28.250521  8595 main.cpp:109] Not starting the distributed query service: Distributed query service not enabled.
I0706 11:43:28.249310  8603 interface.cpp:263] Extension manager service starting: /var/osquery/osquery.em
I0706 11:43:28.250872  8605 events.cpp:746] Starting event publisher run loop: inotify
I0706 11:43:28.250914  8606 events.cpp:746] Starting event publisher run loop: udev
```