osquery
Facebookさんのですね
しかもこれ楽しい！
osquery :: Home
osquery allows you to easily ask questions about your Linux and OSX infrastructure. Whether your goal is intrusion…
osquery.io
Install
osquery :: Downloads
We publish a stable osquery into OS X homebrew every other week. Installing using brew has several advantages: most…
osquery.io
自分の開発機はCentOS6系なんで
rpm -ivh https://osquery-packages.s3.amazonaws.com/centos6/noarch/osquery-s3-centos6-repo-1-0.0.noarch.rpm
yum install osquery起動
/etc/init.d/osqueryd start
No config file found at /etc/osquery/osquery.conf
Additionally, no flags file or config override found at /etc/osquery/osquery.flags
See ‘/usr/share/osquery/osquery.example.conf’ for an example config.エラッた！
configがないって言われてるから
ls /usr/share/osquery/osquery.example.conf
cat /usr/share/osquery/osquery.example.conffileあるんで中身確認しつつ
cp -p /usr/share/osquery/osquery.example.conf /etc/osquery/osquery.conf再度起動
/etc/init.d/osqueryd startなんも返ってこないｗ
pgrep osqueryd
17968
17977
ps aux | grep osquerydなんか返ってきたｗ
osqueryi
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
osquery — being built, with love, at Facebook
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Connected to a transient in-memory database.
Use “.open FILENAME” to reopen on a persistent database.
osquery>なんかInterfaceが起動したｗ
Query発行！
よくLink先のtableみて
osquery :: Tables
There are some operating-specific tables that apply to OS X, Ubuntu, or CentOS only. osquery stresses feature parity…
osquery.io
なんか適当にQuery発行してみる
osquery> SELECT address, mac, id.interface
…> FROM interface_details AS id, interface_addresses AS ia WHERE id.interface = ia.interface;
+ — — — — — — — — — — — — — + — — — — — — — — — -+ — — — — — -+
| address | mac | interface |
+ — — — — — — — — — — — — — + — — — — — — — — — -+ — — — — — -+
| 127.0.0.1 | 00:00:00:00:00:00 | lo |
| ::1 | 00:00:00:00:00:00 | lo |
| xx.xxx.xxx.xxx | xx:xx:xx:xx:xx:xx | eth0 |
| xxxx::xxxx:xxx:xxxx:xxxx | xx:xx:xx:xx:xx:xx | eth0 |
+ — — — — — — — — — — — — — + — — — — — — — — — -+ — — — — — -+返ってくる！（一応LocalだけどIPだから伏せてるけど
osquery> SELECT name,version FROM rpm_packages;
~~~~~~省略~~~~~~
| libssh2 | 1.4.2 |
| curl | 7.19.7 |
+ — — — — — — — — — — — — — — — — -+ — — — — — — — — — +あか〜〜ん！楽しいこれ！
インフラエンジニアみんな大好きFD確認！
以下のTableを使ってなんかごにょごにょ
- processes
- process_open_files
osquery> select processes.name,sum(process_open_files.fd)
…> from process_open_files,processes
…> where process_open_files.pid = processes.pid
…> group by process_open_files.pid;
+ — — — — — — — — -+ — — — — — — — — — — — — — — +
| name | sum(process_open_files.fd) |
+ — — — — — — — — -+ — — — — — — — — — — — — — — +
| init | 14 |
| udevd | 19 |
| udevd | 9 |
| dhclient | 6 |
| rsyslogd | 21 |
| irqbalance | 3 |
| dbus-daemon | 12 |
| acpid | 6 |
| hald | 52 |
| hald-runner | 3 |
| hald-addon-inpu | 12 |
| hald-addon-acpi | 3 |
| udevd | 9 |
| automount | 105 |
| sshd | 8 |
| sshd | 32 |
| bash | 258 |
| bash | 258 |
| manage_accounts | 3 |
| abrtd | 14 |
| abrt-dump-oops | 10 |
| python | 3 |
| atd | 6 |
| stackdriver-col | 6 |
| ssh | 18 |
| manage_addresse | 7 |
| mingetty | 3 |
| mingetty | 3 |
| mingetty | 3 |
| mingetty | 3 |
| mingetty | 3 |
| mingetty | 3 |
| agetty | 3 |
| ntpd | 3 |
| consul | 99 |
| httpd | 18 |
| httpd | 27 |
| httpd | 27 |
| httpd | 27 |
| nginx | 18 |
| nginx | 37 |
| sshd | 8 |
| sshd | 32 |
| bash | 258 |
| redis-server | 6 |
| redis-server | 6 |
| bash | 258 |
| redis-server | 6 |
| haproxy | 0 |
| perl | 3 |
| mongos | 10 |
| gocode | 1 |
| serf | 11 |
| mongod | 83 |
| mongod | 104 |
| mongod | 42 |
| mongod | 100 |
| osqueryd | 3 |
| osqueryd | 21 |
| osqueryi | 38 |
| httpd | 27 |
| manage_accounts | 7 |
| java | 35179 |
| auditd | 24 |
| epmd | 3 |
| crond | 11 |
| mysqld_safe | 258 |
| gate | 3 |
| gate | 26 |
| mysqld | 22636 |
| influxdb | 3 |
| influxdb | 51656 |
+ — — — — — — — — -+ — — — — — — — — — — — — — — +やばいたのしいこれ！ｗ
転載：osquery
この記事は Medium（@yusuke_h） からの転載です。
この記事を書いた人
