When I run a "osqueryi --json" query that includes multiple SELECTs, it returns a single array merging the output of all the commands with no way to tell them apart. Paste: http://paste.debian.net/plain/1224268 (I would have more commands in reality). I realize this isn't the established approach, but in my specific case my life would be a lot easier if I could run a single osqueryi command (via SSH) every minute, and receive a single valid JSON object in response, that is structured in a parsable way.
12/21/2021, 3:38 PM
Recognizing this use case is a bit odd (And TBH I think harder than using the socket to communicate with a daemon)...
I'm, not sure how I feel about making that kind of change. It's a change in something akin to an API, so there are lots of drawbacks. And as it's not entirely a use case I think is common, it's not what I'd optimize for.
That said, you have at least one clever workaround. You can embed some kind of query identifier in your query directly. eg: something like:
osqueryd -S --json "select 'time' as _query, * from time; select 'osquery_info' as _query, * from osquery_info"
What kind of usage is pushing you to ssh + exec? Especially every minute?