Can we run

osqueryi

when

osqueryd

is already running ?

Yes. Note that

osqueryi

will not have access to the events stored in

osqueryd

.

@zwass Thanks for the info. I am facing an issue on one of my machines.. I used subprocess.run(['osqueryi', '--json', 'select * from os_version'], stdout=subprocess.PIPE, universal_newlines=True). But surprisingly, the output of subprocess.run is "". But when I run using osqueryi --json 'select * from os_version' its working fine. Not sure why.. Do you have any inputs here ?

Is that the exact command you are running? I copied and it works

Yes its working on some machines, but suddenly on one of the machines it doesn't work..

Hmm, not sure what that would be, but I'd be 99% sure it has nothing to do with osqueryd running.

Yeah.. thanks for following up..