Adam S
12/30/2021, 3:19 AMStefano Bonicatti
12/30/2021, 9:49 AMAdam S
12/30/2021, 1:54 PMSELECT hostname, cpu_type, cpu_brand, cpu_physical_cores, cpu_logical_cores, physical_memory FROM system_info;
For the disk space, I use this query:
SELECT device_id, ROUND(free_space * 10e-10) AS free_gb, ROUND(size * 10e-10) AS size_gb, boot_partition AS boot FROM logical_drives WHERE file_system = 'NTFS';
Stefano Bonicatti
12/30/2021, 3:07 PMAdam S
12/30/2021, 3:11 PMseph
12/30/2021, 11:29 PMif (GetPhysicallyInstalledSystemMemory(&physicallyInstallMemory)) {
r["physical_memory"] = BIGINT(physicallyInstallMemory * 1024);
See https://github.com/osquery/osquery/pull/7028ROUND(size * 10e-10)
seems off. Are you running into gibibyte vs gigabyte conversions?Adam S
12/31/2021, 4:14 PMStefano Bonicatti
12/31/2021, 4:46 PMGet-WmiObject -Query select DeviceID, Description, FreeSpace, Size, FileSystem from Win32_LogicalDisk
, via powershell.Get-Disk
command. So technically the nomenclature that Get-Disk
is using is incorrect.Adam S
12/31/2021, 8:43 PMStefano Bonicatti
12/31/2021, 11:56 PMseph
01/01/2022, 12:25 AMAdam S
01/01/2022, 2:27 AM