Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Is there a schedule when Orbit on the stable channel will update osquery to version 5.5.1 or am I misunderstanding how this works?

Hi <@U0F56K00Z>! We don't have a specific schedule for bringing new osquery versions to the stable channel.

There's a lot of testing that happens and tweaks may be necessary, so it's difficult to judge ahead of time how long it might take.

Is there a reason you're keen to get up and running with 5.5.1?

Thanks for the reply. Interested in the new `unified_log` table for macOS

That's a cool one! If it's something you'd like to play with while you wait, you could deploy 5.5.1 to some hosts with vanilla osquery :)

We currently have 5.5.1 available on the `edge` channel. You'll get it if you build packages with `--osqueryd-channel=edge` or `--osqueryd-channel=5.5.1` (which would also disable updates because you would be pinning the package to 5.5.1. We will push it to the `stable` channel when osquery  project declares it stable.

Good info, thanks for following up. 

Is pushing to the stable channel when the release is declared stable the general workflow? 

We try to push to `edge` ASAP after the release is tagged and then to `stable` ASAP after the release is declared stable.

This info would make a good addition to the Orbit readme. 

<@U02KY9FDA59> can you please help get this into the docs?

Done!
<https://github.com/fleetdm/fleet/pull/7760>
<https://github.com/fleetdm/fleet/pull/7761>