4 ms·
osquery is a cool project, with a lot of outstanding issues. It has a great deal of technical debt, including performance and security debts that don't receive
by woodruffw 3y ago
osquery is a cool project, with a lot of outstanding issues. It has a great deal of technical debt, including performance and security debts that don't receive adequate attention. It also has a huge user community around it, but only a handful of active recurring contributors and companies actually funding development on it (and, even then, the bulk of the development is feature work rather than debt burndown).
(Source: I worked on osquery's core and tables for 2-3 years for various clients, and my company employs several of the current maintainers.)
- PenguinCoder 3y agoAgreed with that first statement. Some of the things osquery does especially with regards to Linux disk space usage, is frustrating to deal with.
- mikermcneil 3y agoWhat did you run into on Linux?
- PenguinCoder 3y ago> Linux disk space usage reporting issues
- mikermcneil 3y agoIn https://fleetdm.com/tables/mounts https://fleetdm.com/tables/mounts ?
- neodymiumphish 3y agoIt’s also the base layer for Sophos’ EDR platform.
- woodruffw 3y agoIt's the base layer for a lot of EDRs :-)
- EvanAnderson 3y agoAlienvault's endpoint security tool thingamagic uses it too.
- deleted 3y ago[deleted]
- Myrmornis 3y agoI don't know about production, but I use it on my MacOS laptop to list all listening sockets with the associated command line. Should I be concerned that this sort of thing has correctness bugs? (Can anyone give a competing non-osquery implementation on MacOS?) sockets() { (osqueryi --list --separator ',' | column -t -s ',') <<EOF SELECT s.local_port, p.cmdline FROM process_open_sockets AS s INNER JOIN processes AS p ON s.pid = p.pid WHERE s.state = 'LISTEN' ORDER BY p.cmdline; EOF }
- woodruffw 3y agoThere's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error, you probably aren't hitting it. But that's a good example of the kind of debt that's been built up over time. (In terms of general purpose/flexible tooling, I'm not aware of a close replacement for osquery.) [1]: https://github.com/osquery/osquery/issues/6319 https://github.com/osquery/osquery/issues/6319
- Myrmornis 3y agoThanks! I'll watch out for that one.
- mikermcneil 3y agoWas about to say "will fix ASAP", but double-plus since it's @nyanshak!
- deleted 3y ago[deleted]
- noahtaleran 3y agoYo! We're working on the fix. You can track progress here: https://github.com/fleetdm/fleet/issues/17165 https://github.com/fleetdm/fleet/issues/17165
- signa11 3y ago> Can anyone give a competing non-osquery implementation on MacOS? shouldn't lsof with some awk munging get you there ? edit-01: for example lsof -iTCP -sTCP:LISTEN -n -P | awk '{print $1, substr($0, index($0,$9))}' might be useful enough ? fwiw, it does give me something useful on my machine