Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Can we run `osqueryi` when `osqueryd` is already running ?

Yes. Note that `osqueryi` will not have access to the events stored in `osqueryd`.

<@U0JFM04MS> Thanks for the info. I am facing an issue on one of my machines.. I used subprocess.run(['osqueryi', '--json', 'select * from os_version'], stdout=subprocess.PIPE, universal_newlines=True). But surprisingly, the output of subprocess.run is "". But when I run using osqueryi --json 'select * from os_version' its working fine. Not sure why.. Do you have any inputs here ?

Is that the exact command you are running? I copied and it works

Yes its working on some machines, but suddenly on one of the machines it doesn't work..

I think there is a problem with the subprocess.run command on that machine.. not sure.. trying to figure out the root cause of this issue

Hmm, not sure what that would be, but I'd be 99% sure it has nothing to do with osqueryd running.