Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

github.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#21

Post by rmetzler »

y4mi wrote: post #2

I stil remember the initial announcement of this years ago... I wasn't able to use it back then but saved it for later. I'm currently in a situation in which I'd love to use osquery which is why I tried it out a few month ago. Sadly, there wasn't any inbuilt multi-node/cluster functionality to speak of. I gave up on it as it's utility is pretty low if you're constrained to localhost queries... And the third party "cl…

I had a little bit of the same problem and while I think the third party Software like fleet should work (Never really had enough time to try it out at work) I wrote a small ansible module to integrate osqueryi.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#22

Post by rmetzler »

techntoke wrote: post #3

The Linux kernel already has a pretty good API available via file nodes. And there are other lightweight tools to gather and parse information. Not sure I understand the benefits of exposing it through SQL, but I know some people are obsessed with SQL.

My use case was something like: for all users of the os give me all ssh fingerprints in .ssh/authorized_keys and stuff like that. Mostly for security and compliance.

My other usecase is netstat working different on Linux and macOS, so I alias an osqueryi command on macOS to show me which process opens which port.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#23

Post by wglb »

NohatCoder wrote: post #17

Am I the only person who read "SQL-powered operating system"? It is just plausible enough to be imaginable. Everything is a table! Write applications using only SQL statements!

I learned that key parts of Azure involve MSSQL deep in the infrastructure.

The AS400 operating system had SQL as a key part of the core functionality.

So there is that.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#24

Post by hobs »

NohatCoder wrote: post #17

Am I the only person who read "SQL-powered operating system"? It is just plausible enough to be imaginable. Everything is a table! Write applications using only SQL statements!

It's not that far off from what WinFS had envisioned: https://en.wikipedia.org/wiki/WinFS

>WinFS includes a relational database for storage of information, and allows any type of information to be stored in it, provided there is a well defined schema for the type. Individual data items could then be related together by relationships, which are either inferred by the system based on certain attributes or explicitly stated by the user. As the data has a well defined schema, any application can reuse the data; and using the relationships, related data can be effectively organized as well as retrieved. Because the system knows the structure and intent of the information, it can be used to make complex queries that enable advanced searching through the data and aggregating various data items by exploiting the relationships between them.

From what I heard, it was slow, and devs just were not that interested in some clean schema based interface because it complicated their ability to ship; interesting that the modern approach seems to also favor schema on write.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#25

Post by aasasd »

NohatCoder wrote: post #17

Am I the only person who read "SQL-powered operating system"? It is just plausible enough to be imaginable. Everything is a table! Write applications using only SQL statements!

A filesystem isn't so different from a database in the first place. Not really relational, but still.

The olde PalmOS had databases as primary storage. Though databases seem to have had capacity for blobs, since apps themselves were stored that way, aside from text files, images and whatnot.

In fact, afaik some mainframe OSes were built around databases.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#26

Post by jpcosta »

jasonjayr wrote: post #20

Something like this already exists for Windows[1] There is apparently a standard[2] for exposing operating system objects into a schema that can have a standard query. I don't think I've ever seen any common monitoring projects built using WMI/WBEM at their core ... [1]: https://docs.microsoft.com/en-us/windows/win32/wmisdk/about-... [2]: https://stackoverflow.com/questions/921617/is-there-somethin...

afaik one of the main motivations that led to start osquery project was precisely to have a cross platform tool to allow collecting much needed information from all your hosts in an enterprise setting

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#27

Post by patangay »

gen220 wrote: post #11

Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roadmap for this project was a little bit too unpredictable, and that they weren’t responsive to PRs and community requests. I think we went with https://github.com/osql/osql . It’s installed on every laptop (chrome books and MacBooks), and I believe on every EC2…

Snowalert running on Snowflake is a reasonable aggregator/alerting solution for anyone looking to do this. https://community.snowflake.com/s/article/Snowflake-Using-Sn...

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#28

Post by tony »

Amazing

CMake, clang-format, watchman

The code looks beautiful, examaple: https://github.com/osquery/osquery/blob/master/osquery/files...

> https://github.com/osquery/osquery/blob/master/LICENSE > If you're using osquery you are free to choose one of the provided licenses.

If GPLv2 is optional, then why have it all? (To give the user flexibility since GPLv2 isn't forward compatible to from Apache2)

A simpler license w/ a separate patent exception would give the user choice, a forker could "upcast" to any forward-compatible license.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#29

Post by tabtab »

NohatCoder wrote: post #17

Am I the only person who read "SQL-powered operating system"? It is just plausible enough to be imaginable. Everything is a table! Write applications using only SQL statements!

Table-Oriented-Programming may finally hit the mainstream.

Re: Osquery: SQL-powered operating system instrumentation, monitoring, and analytics

#30

Post by [deleted] »

tony wrote: post #28

Amazing CMake, clang-format, watchman The code looks beautiful, examaple: https://github.com/osquery/osquery/blob/master/osquery/files... > https://github.com/osquery/osquery/blob/master/LICENSE > If you're using osquery you are free to choose one of the provided licenses. If GPLv2 is optional, then why have it all? (To give the user flexibility since GPLv2 isn't forward compatible to from Apache2) A simpler license…

[deleted]
Post reply on HN