spookerlabs
09/11/2018, 5:59 PMBeetleJuice:~ root# osqueryi
Using a virtual database. Need help, type '.help'
osquery> .show
osquery - being built, with love, at Facebook
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
osquery 3.3.0
using SQLite 3.19.3
General settings:
Flagfile:
Config: filesystem (/var/osquery/osquery.conf)
Logger: filesystem (/var/log/osquery/)
Distributed: tls
Database: ephemeral
Extensions: core
Socket: /var/root/.osquery/shell.em
Shell settings:
echo: off
headers: on
mode: pretty
nullvalue: ""
output: stdout
separator: "|"
width:
Non-default flags/options:
database_path: /var/root/.osquery/shell.db
disable_database: true
disable_events: true
disable_logging: true
disable_watchdog: true
extensions_socket: /var/root/.osquery/shell.em
hash_delay: 0
logtostderr: true
stderrthreshold: 3
osquery> select u.uid,u.shell,username,path,encrypted from users u JOIN user_ssh_keys USING(uid);
libc++abi.dylib: terminating with uncaught exception of type boost::filesystem::filesystem_error: boost::filesystem::current_path: Permission denied
Abort trap: 6