https://github.com/osquery/osquery logo
#general
Title
# general
m

marpaia

06/05/2018, 8:07 PM
yeah, i saw that the new app execs osqueryi. that’s not a great pattern imo.
d

defensivedepth

06/05/2018, 8:14 PM
Can you give me some context around why this is not a good idea?
m

marpaia

06/05/2018, 8:16 PM
a lot happen when you
exec
a process… if you’re doing it often, in a loop, or as apart of consistent operations of a tool, it’s incredibly inefficient
the HIDS i wrote at etsy used to exec like all hell
and it was obnoxiously resource intensive because of it
this was the motivation for the “no shelling out” rule in osquery
as well as the local socket and the
Query
method so that all of this could happen without
exec
g

groob

06/05/2018, 8:27 PM
you also have to spend extra resources validating command output and stderr for all the ways it can fail
d

defensivedepth

06/05/2018, 8:53 PM
thanks, that helps.
So for a standalone tool, if I wanted to run a bunch of queries and then generate a pdf report from the results -- using the thrift API + osqueryd would be preferable to using osqueryi?
g

groob

06/05/2018, 8:56 PM
you can use thrift with osqueryi too. it’s the same API
m

marpaia

06/05/2018, 10:03 PM
but yeah, start an osquery{d/i} and then run as many queries as you want via the thrift api
4 Views