Title
#core
s

seph

06/15/2022, 6:57 PM
Hrm. As I tinkering around m1 things, I think we made it hard. We have pretty comprehensive support for platforms. They’re in the schema, we expose a bitfield of them. Etc. But we don’t expose any kind of architecture info. It’s not in
osquery_info
. It’s not in the table schema. Etc.
s

sharvil

06/15/2022, 7:01 PM
cpu_type
from
system_info
should have that iirc
7:01 PM
or is that not what you mean?>
Mike Myers

Mike Myers

06/15/2022, 7:38 PM
Well it's not on the website where the user wants to know why the table exists or doesn't exist for them, or why it's empty
7:39 PM
I think we have a gap in ownership of the osquery website, there are a few things that could be improved about the schema view there
s

seph

06/15/2022, 9:23 PM
Maybe a gap in ownership, but I think it’s a gap in knowledge. To some degree, nothing has an owner, we’re a loose collective. But none of us are super knowledgable about js SPA stuff, so the website is a bit grotty.
9:24 PM
But I’m not thinking about the website. I’m thinking about the schemas. Kolide parses them, and tracks a lot of what-should-work where. But because osquery doesn’t really differenciante by arch, we hadn’t either. So now I’m grafting it on. But it’s imperfect.
9:25 PM
cpu_type
from
system_info
is (ideally) what the system is. But it is not what osquery was compiled for.
Daniel Bretón Suárez

Daniel Bretón Suárez

06/16/2022, 2:52 PM
Out of curiosity, is there any table that works/doesn't work on a Linux with ARM architecture?
s

seph

06/16/2022, 3:10 PM
cpuid is intel specific. There may be others.
Mike Myers

Mike Myers

06/16/2022, 4:32 PM
Probably the tables that rely on SMBIOS https://github.com/osquery/osquery/issues/7588
Stefano Bonicatti

Stefano Bonicatti

06/17/2022, 7:28 AM
SMBIOS works under Linux ARM, it’s only Apple M1 devices