https://github.com/osquery/osquery logo
Title
z

Zweasta

06/19/2020, 8:28 PM
Can we run
osqueryi
when
osqueryd
is already running ?
z

zwass

06/19/2020, 8:41 PM
Yes. Note that
osqueryi
will not have access to the events stored in
osqueryd
.
z

Zweasta

06/19/2020, 8:45 PM
@zwass Thanks for the info. I am facing an issue on one of my machines.. I used subprocess.run(['osqueryi', '--json', 'select * from os_version'], stdout=subprocess.PIPE, universal_newlines=True). But surprisingly, the output of subprocess.run is "". But when I run using osqueryi --json 'select * from os_version' its working fine. Not sure why.. Do you have any inputs here ?
z

zwass

06/19/2020, 9:08 PM
Is that the exact command you are running? I copied and it works
z

Zweasta

06/19/2020, 9:09 PM
Yes its working on some machines, but suddenly on one of the machines it doesn't work..
I think there is a problem with the subprocess.run command on that machine.. not sure.. trying to figure out the root cause of this issue
z

zwass

06/19/2020, 9:12 PM
Hmm, not sure what that would be, but I'd be 99% sure it has nothing to do with osqueryd running.
z

Zweasta

06/19/2020, 9:15 PM
Yeah.. thanks for following up..