Hello, if I set some environment variables in the OS, can I retrieve them using OSQuery? Or alternatively is there some other method where I can retrieve a constant value that I set per device? I was setting a decorator query in each .conf file previously to do this, but since moving to fleet, having the shared conf means I can't do that now, so I guess setting an Environment variable on heach machine and querying it will be best way?
11 months ago
Maybe, depends a lot on the details and operating system.Environment variables run in an environment. Which is associated with a process, not some hypothetical thing. So to read them from osquery you either need them in osquery’s environment, or you need to pick a specific process to read them from. This is generally awkward.If you want to pick up some bit of information from a host, I’d look at using something like the plist table on macos, and the registry on windows. I’d have to skim the tables to see what might work from linux. But there are likely others.Find something like that
when try to use that table you supplied. osquery says it doesn't existOh not for windows, I see the apple and penguin now lol.So we really have no mechanisim to see environment variables on windows at all?