https://github.com/osquery/osquery logo
a

Adrian Junge

01/11/2023, 4:55 PM
Hello everyone, is there any table in osquery returning a unique and persistent ID for the device osquery is running on? The UUID in system_info is unique but after a reboot it changes in my VM.
m

Mike S.

01/11/2023, 5:06 PM
Hi Adrian - I think you have the right idea of using UUID in system_info - depending on the VM software being used, I believe there's a configuration file or option in VMWare/Virtualbox that lets you configure a persistent UUID.
s

seph

01/11/2023, 7:57 PM
I think this is probably not osquery… But instead a question of how one uniquely and persistently identifies a VM.
a

Adrian Junge

01/12/2023, 7:03 PM
Alright thank you both. The mac addresses from the interface_details table seem to be unique and persistent also for VMs, is that true?
s

seph

01/12/2023, 7:04 PM
That is a question for your VM systems, I do not know the answer.