Title
#general
zwass

zwass

08/05/2021, 1:38 AM
Anyone know a query that can reliably (across osquery versions) identify if osquery is running on Linux? I thought this would do, but the results are inconsistent:
SELECT 1 FROM osquery_info WHERE build_platform = 'linux'
.
jordi

jordi

08/05/2021, 1:47 AM
do you want to identify all the machines that are running any linux distro or you want information about the exact distro?
s

seph

08/05/2021, 2:47 AM
Heh. IIRC we don’t expose the platform information usefully. Sometimes it’s “linux” sometimes it’s a random distro name. And there’s an
acts_like
that’s also wrong.
2:47 AM
You might be able to say
not darwin, not windows
2:47 AM
Or, use the bitmask.
2:48 AM
(I added the bitmask because we don’t expose this usefully, and that seemed like a fine backstop)
puffycid

puffycid

08/05/2021, 2:51 AM
Does
os_version
work? Specifically the
platform_like
column? Or is that not 100% reliable?
s

seph

08/05/2021, 2:56 AM
It’s weird. IIRC redhat and centos just id as centos for both platform and platform_like. Something like that. I’d have to dig through notes or source code.
zwass

zwass

08/05/2021, 3:56 PM
Thanks for the insights all! I'm looking for "any linux distro".
s

seph

08/05/2021, 3:57 PM
I’d use the bitmask.