When I query the table

smart_drive_info

I get results for all partitions on the node. Does this make sense? I have the values

/dev/sdb

,

/dev/sdb1

and

/dev/sdb2

in the column

device_name

and all other columns are sharing the same values as they belong to one disk. Is there a way to filter for block devices only?

Maybe not what you’re hoping for, but

smart_drive_info

is deprecated, and due to be removed. https://github.com/osquery/osquery/issues/7464

Oh that’s too bad. Querying for disks with

smart

errors is pretty important regarding system stability. Let’s hope this functionality will come back based on another / maintained library.

This looks like just a “particular” implementation decision. In any case osquery has the

block_devices

table where you could take the disks by selecting the rows with empty

parent

Agreed. It's nice functionality. But no library means no library. :/