osquery 简介osquery是一个SQL驱动操作系统检测和分析工具。osquery支持像SQL语句一样查询系统的各项指标可以用于OSX和Linux操作系统。它使得底层操作系统分析和监控性能更加直观项目主页http://osquery.io/代码托管地址https://github.com/facebook/osquerosquery 安装代码语言javascriptAI代码解释[rootlinuxprobe~]# yum -y install https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm [rootlinuxprobe~]# yum -y install osqueryosquery 使用文档 https://osquery.io/docs/tables/代码语言javascriptAI代码解释# 使用例子 # run osquery shell [rootlinuxprobe~]# osqueryi osquery - being built, with love, at Facebook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Using a virtual database. Need help, type .help osquery # show all column of tables for OS version osquery select * from os_version; --------------------------------------------------------------------------------------- | name | version | major | minor | patch | build | platform | platform_like | codename | --------------------------------------------------------------------------------------- | CentOS Linux | 7 (Core) | 7 | | | | centos | rhel fedora | | --------------------------------------------------------------------------------------- # show some column of tables for System info osquery select hostname, cpu_brand, hardware_vendor, hardware_model from system_info; --------------------------------------------------------------------------------------------------- | hostname | cpu_brand | hardware_vendor | hardware_model | --------------------------------------------------------------------------------------------------- | linuxprobe.org | Intel(R) Core(TM) i5-4590 CPU 3.30GHz | VMware, Inc. | VMware Virtual Platform | --------------------------------------------------------------------------------------------------- # show some column of tables and also specify over 1000 of UID for User info osquery select uid, gid, username, shell from users where uid 1000; ---------------------------------------- | uid | gid | username | shell | ---------------------------------------- | 1000 | 1000 | shaon | /bin/bash | | 1001 | 1001 | wang | /bin/bash | | 65534 | 65534 | nfsnobody | /sbin/nologin | ---------------------------------------- # show all column of tables for CPU Time osquery select * from cpu_time; --------------------------------------------------------------------------------- | core | user | nice | system | idle | iowait | irq | softirq | steal | guest | guest_nice | --------------------------------------------------------------------------------- | 0 | 912 | 0 | 3679 | 54015 | 2149 | 0 | 157 | 0 | 0 | 0 | --------------------------------------------------------------------------------- # to quit shell, push CtrlD osquery定时监控设置创建osquery配置文件代码语言javascriptAI代码解释[rootlinuxprobe~]# vi /etc/osquery/osquery.conf # create new { options: { // select the osquery config plugin (filesystem is default) config_plugin: filesystem, // select the osquery logging plugin (filesystem is default) logger_plugin: filesystem, // the PATH of log direcroty logger_path: /var/log/osquery, // PID file of the daemon pidfile: /var/osquery/osquery.pidfile, // the number of threads for concurrent query worker_threads: 2, // enable schedule profiling // if adding a query select * from osquery_schedule in schedule section, // its possible to record the performances enable_monitor: true }, schedule: { // for example, get CPU Time per 300 seconds cpu_time: { query: SELECT * FROM cpu_time;, interval: 300 }, // for example, get settings of resolv.conf per an hour dns_resolvers: { query: SELECT * FROM dns_resolvers;, interval: 3600 } }, packs: { // possible to include other configration files hardware-monitoring: /usr/share/osquery/packs/hardware-monitoring.conf } }启动osquery代码语言javascriptAI代码解释[rootlinuxprobe ~]# systemctl start osqueryd [rootlinuxprobe ~]# systemctl enable osqueryd Created symlink from /etc/systemd/system/multi-user.target.wants/osqueryd.service to /usr/lib/systemd/system/osqueryd.service.查看osquery日志代码语言javascriptAI代码解释[rootlinuxprobe osquery]# less /var/log/osquery/osqueryd.results.log