The other half of the machines run the query locally, judging by entires in
SELECT hash.path, file.btime, file.size, file.block_size, file.type, file.uid, file.inode, hash.md5 FROM file LEFT JOIN hash ON hash.path = file.path WHERE file.path LIKE "/Volumes/%%" AND file.path NOT LIKE "/Volumes/Macintosh%" AND file.path NOT LIKE "/Volumes/Recovery%" AND hash.path = file.path AND size>0;
, but never find any results, even though I know they should. Any idea how to even go about trouble-shooting this?
table to see whether it is blacklisted?
table the results will stop being returned as soon as you hit a symlink loop. You can determine if this is the case by running the query locally (on one of the null result devices) in an osqueryi instance that you start in verbose mode.
statements which can take a longer time to return results by instead doing something like this:
SELECT hash.path, hash.md5, file.size, file.block_size, file.type, file.uid, file.inode FROM file LEFT JOIN hash USING (path) WHERE file.path LIKE '/Volumes/%%' AND SPLIT(file.path, '/', 1) NOT IN ('Macintosh HD', 'Recovery', 'BOOTCAMP') AND file.size > 0
It might be worth investigating whether you can get the desired files instead via the
table keying off of some metadata attribute.
column, you cannot simply:
to avoid the loops.
AND file.symlink = 0