--- title: "osquery | grasys blog" url: "https://blog.grasys.io/post/yusukeh/osquery" description: "Facebookさんのですね しかもこれ楽しい！ osquery :: Home osquery allows you to easily ask questions about your Linux and OSX infrastructure. Whether your goal is intrusion… osquery.io Install osquery :: Downloads We publish a stable osq…" --- # osquery - ![](/_astro/noicon.CTHOhNiB_1HMs6A.webp)[yusukeh](/authors/yusukeh/) - 公開日：2015年3月24日 - カテゴリー：[Tech](/categories/tech/) - タグ：[#osquery](/tags/osquery/)[#セキュリティ](/tags/セキュリティ/) ![osquery](/_astro/ogp.DdohqSUF_siywJ.webp) Facebookさんのですね しかもこれ楽しい！ ## osquery :: Home ### osquery allows you to easily ask questions about your Linux and OSX infrastructure. Whether your goal is intrusion… osquery.io ## Install ## osquery :: Downloads ### We publish a stable osquery into OS X homebrew every other week. Installing using brew has several advantages: most… osquery.io 自分の開発機はCentOS6系なんで Plain textcontent\_copy ``` rpm -ivh https://osquery-packages.s3.amazonaws.com/centos6/noarch/osquery-s3-centos6-repo-1-0.0.noarch.rpm yum install osquery ``` 起動 Plain textcontent\_copy ``` /etc/init.d/osqueryd start No config file found at /etc/osquery/osquery.conf Additionally, no flags file or config override found at /etc/osquery/osquery.flags See ‘/usr/share/osquery/osquery.example.conf’ for an example config. ``` エラッた！ configがないって言われてるから Plain textcontent\_copy ``` ls /usr/share/osquery/osquery.example.conf cat /usr/share/osquery/osquery.example.conf ``` fileあるんで中身確認しつつ Plain textcontent\_copy ``` cp -p /usr/share/osquery/osquery.example.conf /etc/osquery/osquery.conf ``` 再度起動 Plain textcontent\_copy ``` /etc/init.d/osqueryd start ``` なんも返ってこないｗ Plain textcontent\_copy ``` pgrep osqueryd 17968 17977 ps aux | grep osqueryd ``` なんか返ってきたｗ Plain textcontent\_copy ``` osqueryi ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ osquery — being built, with love, at Facebook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Connected to a transient in-memory database. Use “.open FILENAME” to reopen on a persistent database. osquery> ``` なんかInterfaceが起動したｗ ## Query発行！ よくLink先のtableみて ## osquery :: Tables ### There are some operating-specific tables that apply to OS X, Ubuntu, or CentOS only. osquery stresses feature parity… osquery.io なんか適当にQuery発行してみる Plain textcontent\_copy ``` osquery> SELECT address, mac, id.interface …> FROM interface_details AS id, interface_addresses AS ia WHERE id.interface = ia.interface; + — — — — — — — — — — — — — + — — — — — — — — — -+ — — — — — -+ | address | mac | interface | + — — — — — — — — — — — — — + — — — — — — — — — -+ — — — — — -+ | 127.0.0.1 | 00:00:00:00:00:00 | lo | | ::1 | 00:00:00:00:00:00 | lo | | xx.xxx.xxx.xxx | xx:xx:xx:xx:xx:xx | eth0 | | xxxx::xxxx:xxx:xxxx:xxxx | xx:xx:xx:xx:xx:xx | eth0 | + — — — — — — — — — — — — — + — — — — — — — — — -+ — — — — — -+ ``` 返ってくる！（一応LocalだけどIPだから伏せてるけど Plain textcontent\_copy ``` osquery> SELECT name,version FROM rpm_packages; ~~~~~~省略~~~~~~ | libssh2 | 1.4.2 | | curl | 7.19.7 | + — — — — — — — — — — — — — — — — -+ — — — — — — — — — + ``` あか〜〜ん！楽しいこれ！ ## インフラエンジニアみんな大好きFD確認！ 以下のTableを使ってなんかごにょごにょ - processes - process\_open\_files Plain textcontent\_copy ``` osquery> select processes.name,sum(process_open_files.fd) …> from process_open_files,processes …> where process_open_files.pid = processes.pid …> group by process_open_files.pid; + — — — — — — — — -+ — — — — — — — — — — — — — — + | name | sum(process_open_files.fd) | + — — — — — — — — -+ — — — — — — — — — — — — — — + | init | 14 | | udevd | 19 | | udevd | 9 | | dhclient | 6 | | rsyslogd | 21 | | irqbalance | 3 | | dbus-daemon | 12 | | acpid | 6 | | hald | 52 | | hald-runner | 3 | | hald-addon-inpu | 12 | | hald-addon-acpi | 3 | | udevd | 9 | | automount | 105 | | sshd | 8 | | sshd | 32 | | bash | 258 | | bash | 258 | | manage_accounts | 3 | | abrtd | 14 | | abrt-dump-oops | 10 | | python | 3 | | atd | 6 | | stackdriver-col | 6 | | ssh | 18 | | manage_addresse | 7 | | mingetty | 3 | | mingetty | 3 | | mingetty | 3 | | mingetty | 3 | | mingetty | 3 | | mingetty | 3 | | agetty | 3 | | ntpd | 3 | | consul | 99 | | httpd | 18 | | httpd | 27 | | httpd | 27 | | httpd | 27 | | nginx | 18 | | nginx | 37 | | sshd | 8 | | sshd | 32 | | bash | 258 | | redis-server | 6 | | redis-server | 6 | | bash | 258 | | redis-server | 6 | | haproxy | 0 | | perl | 3 | | mongos | 10 | | gocode | 1 | | serf | 11 | | mongod | 83 | | mongod | 104 | | mongod | 42 | | mongod | 100 | | osqueryd | 3 | | osqueryd | 21 | | osqueryi | 38 | | httpd | 27 | | manage_accounts | 7 | | java | 35179 | | auditd | 24 | | epmd | 3 | | crond | 11 | | mysqld_safe | 258 | | gate | 3 | | gate | 26 | | mysqld | 22636 | | influxdb | 3 | | influxdb | 51656 | + — — — — — — — — -+ — — — — — — — — — — — — — — + ``` やばいたのしいこれ！ｗ 転載：[osquery](https://medium.com/@yusuke_h/osquery-a7ed4b125624) この記事は [Medium（@yusuke\_h）](https://medium.com/@yusuke_h) からの転載です。 ## この記事を書いた人 [![](/_astro/yusukeh.BvUd2yKE_1mQ6Fp.webp)](/authors/yusukeh/) ### [yusukeh](/authors/yusukeh/) Fly high. Think deep. Move fast. Go far.🦅 - [X](https://x.com/yusukeh "X") - [GitHub](https://github.com/yusukeh "GitHub") - [Medium](https://medium.com/@yusukeh "Medium") - [Facebook](https://www.facebook.com/yusuke.exzm "Facebook") - [Instagram](https://www.instagram.com/yusukehasegawa/ "Instagram") - [LinkedIn](https://www.linkedin.com/in/hasegawa-yusuke-091b4164/ "LinkedIn") [プロフィールと記事一覧](/authors/yusukeh/)