Title
#general
Andreas Piening

Andreas Piening

06/08/2022, 8:30 PM
When I query the table
smart_drive_info
I get results for all partitions on the node. Does this make sense? I have the values
/dev/sdb
,
/dev/sdb1
and
/dev/sdb2
in the column
device_name
and all other columns are sharing the same values as they belong to one disk. Is there a way to filter for block devices only?
s

seph

06/08/2022, 8:36 PM
Maybe not what you’re hoping for, but
smart_drive_info
is deprecated, and due to be removed. https://github.com/osquery/osquery/issues/7464
Andreas Piening

Andreas Piening

06/08/2022, 8:48 PM
Oh that’s too bad. Querying for disks with
smart
errors is pretty important regarding system stability. Let’s hope this functionality will come back based on another / maintained library.
8:49 PM
Thank you anyway.
Stefano Bonicatti

Stefano Bonicatti

06/08/2022, 8:49 PM
This looks like just a “particular” implementation decision. In any case osquery has the
block_devices
table where you could take the disks by selecting the rows with empty
parent
s

seph

06/08/2022, 8:49 PM
Agreed. It's nice functionality. But no library means no library. 😕