Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

image.png

<@U1EUNPP63> commented on <@U8Z3X1Q8J>’s file <https://osquery.slack.com/files/U8Z3X1Q8J/F9898CJ6M/image.png|https://osquery.slack.com/files/U8Z3X1Q8J/F9898CJ6M/image.png>: the path for osquery_results is configured when you start fleet

      --osquery_result_log_file string              Env: KOLIDE_OSQUERY_RESULT_LOG_FILE
		Path for osqueryd result logs (default "/tmp/osquery_result")
      --osquery_status_log_file string              Env: KOLIDE_OSQUERY_STATUS_LOG_FILE
		Path for osqueryd status logs (default "/tmp/osquery_status")