News for hackers. Stuff that matters.

A comment on Osquery: An sqlite3 virtual table exposing operating system data to SQL. Parent comment

Re:Osquery: An sqlite3 virtual table exposing operating syst... by w0de0 on Sunday February 25, 2024 @11:16AM (#39501977)
The senior sysadmins neglected to configure osquery’s client performance safeguards and apply properly scoped access (observer mode!) on the server.

Systems administration is the art of protecting everyone with less access from footguns while still and especially enabling their use of effective tools.

First-person testimony.

[ Parent | on HN ]
Re:Osquery: An sqlite3 virtual table exposing operating syst... by mikermcneil on Sunday February 25, 2024 @06:20PM (#39505983)
Feel your pain! This was the idea behind query performance "bubbles" in Fleet. (Uses the osquery performance metadata to indicate whether performance impact of a query on a host is "minimal", "considerable", or "excessive")

Next step is "clairvoyance", where we predict perf based on the SQL when you're in the query editor

[ Parent | on HN ]