toka06/26/2018, 3:07 PM
is missing on any host, for whatever reason.
table gives me a nice result for machines that have my
in place, but how to invert such query?
SELECT path FROM file WHERE path="some_file"
allister06/26/2018, 4:09 PM
osquery> select type from file where path = '/etc/hosts' and type != 'regular';
toka06/26/2018, 4:31 PM
zwass06/26/2018, 4:46 PM
SELECT 1 AS missing WHERE (SELECT path FROM file WHERE path="some_file") IS NULL;
toka06/26/2018, 5:00 PM
, @zwass this is excellent, thanks!
zwass06/26/2018, 5:01 PM