Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

No let's please text chat. Can you answer my questions from stackoverflow?

OK. Sure. The data is actually getting to Kafka, just to the wrong topic.

```{
  "options": {
    "logger_kafka_brokers": "<http://cp01.woolford.io:9092,cp02.woolford.io:9092,cp03.woolford.io:9092|cp01.woolford.io:9092,cp02.woolford.io:9092,cp03.woolford.io:9092>",
    "logger_kafka_topic": "base_topic",
    "logger_kafka_acks": "1"
  },
  "schedule": {
    "process_port": {
      "query": "select u.username, p.pid, p.name, pos.local_address, pos.local_port, pos.remote_address, pos.remote_port from processes p join users u on u.uid = p.uid join process_open_sockets pos on pos.pid=p.pid where pos.remote_port != '0'",
      "interval": 10,
      "snapshot" : false,
      "removed": true
    }
  },
  "kafka_topics": {
    "process-port": [
      "schedule-process_port"
    ]
  }
}```

So, I can confirm that the Kafka bit works.

And I was getting results when the query was in snapshot mode using the config that’s on Stackoverflow.

I think it’s a bug. <@U0JFM04MS>: <https://youtu.be/sPdlBBKgJmY>

et voila: <https://github.com/osquery/osquery/issues/5890>