Hacker News Reader

Comment by woodruffw | Hacker News Reader

osquery is a cool project, with a lot of outstanding issues. It has a great deal of technical debt, including performance and security debts that don't receive adequate attention. It also has a huge user community around it, but only a handful of active recurring contributors and companies actually funding development on it (and, even then, the bulk of the development is feature work rather than debt burndown).

(Source: I worked on osquery's core and tables for 2-3 years for various clients, and my company employs several of the current maintainers.)

View on HN

I don't know about production, but I use it on my MacOS laptop to list all listening sockets with the associated command line. Should I be concerned that this sort of thing has correctness bugs? (Can anyone give a competing non-osquery implementation on MacOS?)

  sockets() {
    (osqueryi --list --separator ',' | column -t -s ',') <<EOF
  SELECT s.local_port, p.cmdline
  FROM process_open_sockets AS s
  INNER JOIN processes AS p
  ON s.pid = p.pid
  WHERE s.state = 'LISTEN'
  ORDER BY p.cmdline;
  EOF
  }

There's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error, you probably aren't hitting it. But that's a good example of the kind of debt that's been built up over time.

(In terms of general purpose/flexible tooling, I'm not aware of a close replacement for osquery.)

[1]: https://github.com/osquery/osquery/issues/6319

Thanks! I'll watch out for that one.

Was about to say "will fix ASAP", but double-plus since it's @nyanshak!

Yo! We're working on the fix. You can track progress here: https://github.com/fleetdm/fleet/issues/17165

> Can anyone give a competing non-osquery implementation on MacOS?

shouldn't lsof with some awk munging get you there ?

edit-01:

for example

    lsof -iTCP -sTCP:LISTEN -n -P | awk '{print $1, substr($0, index($0,$9))}'

might be useful enough ? fwiw, it does give me something useful on my machine

Thanks, added.

    alias ports="lsof -iTCP -sTCP:LISTEN -n -P | awk '{print \$1, substr(\$0, index(\$0,\$9))}'"

It’s also the base layer for Sophos’ EDR platform.

It's the base layer for a lot of EDRs :-)

Alienvault's endpoint security tool thingamagic uses it too.

Agreed with that first statement. Some of the things osquery does especially with regards to Linux disk space usage, is frustrating to deal with.

What did you run into on Linux?

> Linux disk space usage reporting issues

In https://fleetdm.com/tables/mounts ?

Reply on news.ycombinator.com