Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

github.com

Post reply on HN
Print view View original

11–20 of 36 posts

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#11

Post by gen220 »

Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roadmap for this project was a little bit too unpredictable, and that they weren’t responsive to PRs and community requests. I think we went with https://github.com/osql/osql.

It’s installed on every laptop (chrome books and MacBooks), and I believe on every EC2 instance, and they have nothing but good things to say about it. We did have to come up with an aggregator solution for storing the results of the queries, but I’m under the impression that it wasn’t too big of a lift.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#12

Post by beamatronic »

techntoke wrote: post #3

The Linux kernel already has a pretty good API available via file nodes. And there are other lightweight tools to gather and parse information. Not sure I understand the benefits of exposing it through SQL, but I know some people are obsessed with SQL.

The real power of SQL is joins. But not only might you want to simply query, think about grouping and group functions. For example: say you wanted to know the highest rate of gif file creation per second between two dates, for a certain user. That’s what you could do with a simple sql query.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#13

Post by groobongithub »

gen220 wrote: post #11

Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roadmap for this project was a little bit too unpredictable, and that they weren’t responsive to PRs and community requests. I think we went with https://github.com/osql/osql . It’s installed on every laptop (chrome books and MacBooks), and I believe on every EC2…

Facebook has since transfered the project to the Linux Foundation, and the group behind osql is largely the same group of maintainers on the current osquery.

https://www.linuxfoundation.org/press-release/2019/06/the-li...

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#14

Post by gen220 »

groobongithub wrote: post #13
gen220 wrote: post #11

Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roadmap for this project was a little bit too unpredictable, and that they weren’t responsive to PRs and community requests. I think we went with https://github.com/osql/osql . It’s installed on every laptop (chrome books and MacBooks), and I believe on every EC2…

Facebook has since transfered the project to the Linux Foundation, and the group behind osql is largely the same group of maintainers on the current osquery. https://www.linuxfoundation.org/press-release/2019/06/the-li...

This is great news! Thank goodness that something like the Linux Foundation exists; this is a perfect piece of software for it to absorb.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#15

Post by collyw »

todaysmistakes wrote: post #10

This sounds like my hell on Earth

You don't like SQL? The language syntax isn't great but the relational model behind it is a thing of beauty once you get it IMHO.

It sounds like a really interesting idea to me.

I was disappointed that Microsoft attempt at a relational database was it Win FS failed. Not that I use Windows, but it also seemed to kill the open source attempts at doing something similar.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#16

Post by cube2222 »

I love the idea of providing various functionality under a sql interface. Sure sometimes it doesn't fit, but overall it's one of the better lowest common denominators I've met so far.

I've used osquery a few times on my personal laptop (this post reminds me to try to get the company I work in to adopt it!) and for me it was one of the bigger inspirations for creating OctoSQL[1] as a means for such tools to interoperate.

[1]:https://github.com/cube2222/octosql/

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#18

Post by rmetzler »

NohatCoder wrote: post #17

Am I the only person who read "SQL-powered operating system"? It is just plausible enough to be imaginable. Everything is a table! Write applications using only SQL statements!

Haha, yes osquery works a little bit like this, but is read only on virtual tables backed by the OS.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#19

Post by parasanti »

NohatCoder wrote: post #17

Am I the only person who read "SQL-powered operating system"? It is just plausible enough to be imaginable. Everything is a table! Write applications using only SQL statements!

I read your comment before clicking the link...I thought for sure we had a new OS that was in SQL...I was actually excited and definitely plausible.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#20

Post by jasonjayr »

Something like this already exists for Windows[1]

There is apparently a standard[2] for exposing operating system objects into a schema that can have a standard query.

I don't think I've ever seen any common monitoring projects built using WMI/WBEM at their core ...

[1]: https://docs.microsoft.com/en-us/windows/win32/wmisdk/about-...

[2]: https://stackoverflow.com/questions/921617/is-there-somethin...

Post reply on HN