Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

you want a launchdaemon similar to this

```
&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
    &lt;dict&gt;
        &lt;key&gt;Label&lt;/key&gt;
        &lt;string&gt;com.kolide.corp.osquery&lt;/string&gt;
        &lt;key&gt;RunAtLoad&lt;/key&gt;
        &lt;true/&gt;
        &lt;key&gt;KeepAlive&lt;/key&gt;
        &lt;true/&gt;
        &lt;key&gt;ThrottleInterval&lt;/key&gt;
        &lt;integer&gt;60&lt;/integer&gt;
        &lt;key&gt;ProgramArguments&lt;/key&gt;
        &lt;array&gt;
            &lt;string&gt;/usr/local/kolide-corp/bin/osqueryd&lt;/string&gt;
            &lt;string&gt;--flagfile=/etc/kolide-corp/kolide.flags&lt;/string&gt;
        &lt;/array&gt;
        &lt;key&gt;StandardErrorPath&lt;/key&gt;
        &lt;string&gt;/var/log/kolide-corp/osquery-stderr.log&lt;/string&gt;
        &lt;key&gt;StandardOutPath&lt;/key&gt;
        &lt;string&gt;/var/log/kolide-corp/osquery-stdout.log&lt;/string&gt;
    &lt;/dict&gt;
&lt;/plist&gt;
```