Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

I'm currently in a situation in which I'd love to use osquery which is why I tried it out a few month ago.

Sadly, there wasn't any inbuilt multi-node/cluster functionality to speak of.

I gave up on it as it's utility is pretty low if you're constrained to localhost queries... And the third party "cluster" tools looked pretty barebones and seemed a hassle to setup. And not even really useful, as they just enable you too execute queries on several nodes.

I would want to do queries across servers. (I.e. select load,uptime, hostname where servertype "worker" and kernelversion "3.4")

there was very little value for me which I could already get with an adhoc Ansible task on my servers

- https://github.com/kolide/fleet - https://github.com/mwielgoszewski/doorman - https://github.com/zentralopensource/zentral

Then there are a few freemium:

- https://www.zercurity.com/ (Shameless plug - free for as long as you like) - https://kolide.com/ (Though no SQL interface anymore) - https://www.uptycs.com/ (Free trial)

Hope that helps. I'm sure there are a few others.

However compared to a central metric system that can aggregate metrics across all the hosts, its use quickly becomes less important.

Also there are some CPU considerations, as OSQuery is not as lightweight as other metrics gather tools. Several times I've ran into OSQuery interfering with the actual application, competing for resources. So if you do run it, make to renice it to mitigate this, especially if you're running time-sensitive apps like video/audio.