toka
06/26/2018, 3:07 PMsome_filename
is missing on any host, for whatever reason. file
table gives me a nice result for machines that have my some_filename
in place, but how to invert such query?SELECT path FROM file WHERE path="some_file"
allister
06/26/2018, 4:09 PMosquery> select type from file where path = '/etc/hosts' and type != 'regular';
?toka
06/26/2018, 4:31 PMzwass
06/26/2018, 4:46 PMSELECT 1 AS missing WHERE (SELECT path FROM file WHERE path="some_file") IS NULL;
toka
06/26/2018, 5:00 PMsystem_info
, @zwass this is excellent, thanks!zwass
06/26/2018, 5:01 PM