AND results just from a fresh deployed instance in...
# general
s
AND results just from a fresh deployed instance in Amazon AWS.
Copy code
[root@ip-192-168-164-82 ~]# sudo osqueryi --verbose --debug 'SELECT * FROM process_open_sockets LIMIT 1;'
I0830 08:47:44.839921  2759 init.cpp:392] osquery initialized [version=2.7.0]
I0830 08:47:44.839999  2759 extensions.cpp:288] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load
I0830 08:47:44.840062  2759 init.cpp:615] Cannot start extension manager: Extensions disabled
I0830 08:47:44.840167  2759 init.cpp:651] Error reading config: config file does not exist: /etc/osquery/osquery.conf
I0830 08:47:44.840251  2759 events.cpp:1077] Error registering subscriber: socket_events: Subscriber disabled via configuration
+-----+----+--------+--------+----------+---------------+----------------+------------+-------------+------+
| pid | fd | socket | family | protocol | local_address | remote_address | local_port | remote_port | path |
+-----+----+--------+--------+----------+---------------+----------------+------------+-------------+------+
| -1  | -1 | 10291  | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 111        | 0           |      |
+-----+----+--------+--------+----------+---------------+----------------+------------+-------------+------+