Steve Poe
08/06/2021, 6:06 PMpackage_install_history
updated? I installed two apps yesterday (Evernote and Spotify via brew) and I'd expect them to show up in the package history? I am using osquery 4.9 on macOS 10.15.7. Current uptime: 3 days.theopolis
pkgutil
(it might in some cases) but that table is reporting Installer packages https://en.wikipedia.org/wiki/Installer_(macOS)select * from homebrew_packages
work?seph
package_install_history
reads one of the apple plists. As Teddy says, brew doesn’t use that.Steve Poe
08/08/2021, 2:23 AMallister
08/08/2021, 7:02 AM/Library/Receipts/InstallHistory.plist
as per https://github.com/osquery/osquery/blob/08736648aacaefbdfc90bc2b87acc4414fd6c9ec/osquery/tables/system/darwin/packages.mm#L37-L38Steve Poe
08/10/2021, 7:15 PMallister
08/10/2021, 11:54 PMseph
Steve Poe
08/11/2021, 12:38 AMallister
08/11/2021, 12:40 AMSteve Poe
08/11/2021, 12:42 AMallister
08/11/2021, 12:42 AMSELECT pih.name,
pih.package_id,
receipts.version AS receipt_version,
pih.version,
receipts.location,
receipts.installer_name,
datetime(max(pih.time), 'unixepoch') AS datetime_utc
FROM package_install_history AS pih
JOIN package_receipts AS receipts ON pih.package_id = receipts.package_id
GROUP BY pih.name;
Steve Poe
08/11/2021, 1:06 AMyossarian
08/11/2021, 9:32 PMseph