Hi everyone, is there any way to read query results from osquery socket directly? Right now I'm using Kafka, but checking if there's a way to use a socket in a same way.
👍 1
s
seph
12/28/2021, 12:29 PM
Sort of.
You can use distributed queries over the socket and read the response. (This may not be what you want)
You can write an extension that registers itself as a logger, and then you can use it
s
slevchenko
12/28/2021, 1:18 PM
Thanks. Now Kafka not seem such an overkill :)
s
seph
12/28/2021, 1:42 PM
It all depends on what you're doing with the data. If you have a lot of machines and you're consolidating the data, Kafka isn't a bad choice.
If you have one machine and you want it local, writing to a log file probably makes more sense.