3 ms·
Looks awesome, thanks for making this! osquery has two RFCs related to backend infrastructure[1] and distributed queries[2]. Have you looked at their proposals
by antoncohen 12y ago
Looks awesome, thanks for making this!
osquery has two RFCs related to backend infrastructure[1] and distributed queries[2]. Have you looked at their proposals? How do you think Envdb compares?
I'm curious about the choice of wrapping osquery instead of implementing a logger plugin[3]. Was it easier to implement and deploy as a wrapper?
[1] https://github.com/facebook/osquery/issues/881 https://github.com/facebook/osquery/issues/881
[2] https://github.com/facebook/osquery/issues/201 https://github.com/facebook/osquery/issues/201
[3] https://github.com/facebook/osquery/wiki/registering-logger-plugins https://github.com/facebook/osquery/wiki/registering-logger-...
- nutate 12y agoI had not seen these issues, but I think envdb will be taken as an interesting PoC at the very least of how distributed queries could work.
- mephux 12y agoYea, I looked at them. EnvDB has plans to extend past just using osquery. Work could be done to connect deeper or use libosquery directly. I chose to wrap it and plan to build a plugin system for wrapping other processes. It would make wrapping other stuff to conform to a sql question/answer model easier and faster to implement imho. (either way.. whatever they add wont break envdb ;) hehe)