Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

they are either non-blocking sockets or connections that have failed

hi <@U6EFFT5FG>, could you provide any link/reference where I find any information about status=no for non-blocking sockets?

Status? I think you are referring to "success"?

I don't think there's much documentation about that matter; everything that returns with `exit=` != 0 is emitted with `success=no`

And if you look at the documentation for some syscalls like `connect` (man 3 connect) you can see the following:

```
RETURN VALUE
       Upon successful completion, connect() shall return 0; otherwise, −1 shall be returned and errno set to indicate the error.
```

```
       EINPROGRESS
              O_NONBLOCK is set for the file descriptor for the socket and the connection cannot be immediately established; the connection shall be established asynchronously.
```

Yea, I mean success, not status. It makes sense. Thank you so much for clarification!