https://github.com/osquery/osquery logo
Title
e

ET

08/25/2020, 7:31 AM
Hi guys, When I tried to run
EXISTS(SELECT size from file where path = '/tmp/et.txt')
I get this error : "Error: near "EXISTS": syntax error" Maybe do you have a different solution instead of "EXISTS" ?
s

seph

08/25/2020, 1:12 PM
Osquery uses SQLite as the underlying engine. So whatever works there will work. What is exists supposed to do?
e

ET

08/25/2020, 1:16 PM
I want to know if file EXISTS
Likewise you could write:
SELECT 'true' AS is_present FROM file WHERE path = '/tmp/et.txt'
If you wanted to return a boolean row both when the file was present/missing you could employ
CASE
logic as follows:
SELECT CASE WHEN (SELECT 1 FROM file WHERE path = '/tmp/et.txt') THEN 'true' ELSE 'false' END AS file_present
2
e

ET

08/25/2020, 1:29 PM
Great idea ! Thanks again