Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Screen Shot 2021-08-11 at 6.47.16 pm.png

Hi, `SELECT * FROM startup_items;`  seems to get the split of executable path/args wrong, see it has split at the first space in Program Files" and is listing path and binary in arguments, this is incorrect.

Screen Shot 2021-08-11 at 6.50.21 pm.png

Added image with the table headings for reference

Thanks for reporting this. Does it seem to split incorrectly consistently, or only for some?

<@U023WEX8SA1> it doesn't like the space in "Program Files" so it is incorrectly splitting the string based on that space, it should not do that.

I don't have any paths with a space outside of Program Files in startup to test, but as a dev, to me, logic would suggest that any path with a space in it will do the same thing.

That makes complete sense. I'll file an issue for it on our end. Thanks!

I investigated this and it seems it may be an osquery bug: <https://github.com/fleetdm/fleet/issues/1657>