Title
#general
marpaia

marpaia

06/05/2018, 8:07 PM
yeah, i saw that the new app execs osqueryi. that’s not a great pattern imo.
defensivedepth

defensivedepth

06/05/2018, 8:14 PM
Can you give me some context around why this is not a good idea?
marpaia

marpaia

06/05/2018, 8:16 PM
a lot happen when you
exec
a process… if you’re doing it often, in a loop, or as apart of consistent operations of a tool, it’s incredibly inefficient
8:16 PM
the HIDS i wrote at etsy used to exec like all hell
8:17 PM
and it was obnoxiously resource intensive because of it
8:17 PM
this was the motivation for the “no shelling out” rule in osquery
8:17 PM
as well as the local socket and the
Query
method so that all of this could happen without
exec
g

groob

06/05/2018, 8:27 PM
you also have to spend extra resources validating command output and stderr for all the ways it can fail
defensivedepth

defensivedepth

06/05/2018, 8:53 PM
thanks, that helps.
8:53 PM
So for a standalone tool, if I wanted to run a bunch of queries and then generate a pdf report from the results -- using the thrift API + osqueryd would be preferable to using osqueryi?
g

groob

06/05/2018, 8:56 PM
you can use thrift with osqueryi too. it’s the same API
marpaia

marpaia

06/05/2018, 10:03 PM
but yeah, start an osquery{d/i} and then run as many queries as you want via the thrift api