https://github.com/osquery/osquery logo
Title
l

lankesh

11/13/2022, 7:50 PM
Hi experts, I have a requirement to run scheduled os queries and send the output to another process(xyz.exe) which is already running in same device. I know 'osqueryd' logs json output at some location. But is it possible to send the results of queries to another process. Please help me clarifying how to do this in c++.
s

seph

11/15/2022, 3:36 PM
This depends a lot on you. osquery normally outputs to files or a remote TLS server. The simple thing is to have your other process read it’s files. The less simple thing is to have the other thing act as a TLS endpoint. If you cannot change the other process, you could probably write a logger plugin to run with osquery. Which would receive the logs over the thrift socket, and then do whatever you wanted with them. This could be written in any language, there are reasonable SDKs for go and python. c++ is a bit weird,
But you’re doing something fairly complicated and unsuported.
l

lankesh

11/15/2022, 3:38 PM
Thank you..
s

seph

11/15/2022, 3:46 PM
Folks here will generally help, but we can’t solve this one.
l

lankesh

11/15/2022, 3:47 PM
Yeah, it has complexity. And confusions.
Cannot use file monitoring to read json logs.
Have to see how we can make use of TLS