Osquery: An sqlite3 virtual table exposing operating system data to SQL

Re:Osquery: An sqlite3 virtual table exposing operating syst... by infogulch on Sunday February 25, 2024 @12:04PM (#39502461)

Sqlite is embedded, so how do you actually build it into your app? Is there a C file somewhere, an amalgamation published? I haven't been able to find it, but surely it exists.

I'd like to build a Go binary with mattn/go-sqlite3 with osquery vtables included.

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by woodruffw on Sunday February 25, 2024 @12:13PM (#39502543)

The SQLite amalgamation releases are here[1]. I don't remember off the top of my head how osquery integrates it, however.

[1]: https://sqlite.org/amalgamation.html

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by w0de0 on Sunday February 25, 2024 @12:12PM (#39502538)

https://github.com/osquery/osquery/tree/master/osquery/sql

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by tehlike on Sunday February 25, 2024 @12:13PM (#39502551)

is a shared library you can embed into your app.

or you can use it in a server/client setting through some other project, but probably not you wanted

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by mikermcneil on Sunday February 25, 2024 @11:27PM (#39507671)

runs as a daemon, communicates over http

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by mikermcneil on Sunday February 25, 2024 @06:01PM (#39505834)

They did an amazing feat of engineering. Mike Arpaia's brainchild, co-created by my cofounder zwass at Fleet, and massively improved by seph (@directionless), ted reed, alessandro, sharvil, and many others: https://github.com/osquery/osquery/graphs/contributors

[ Parent | on HN ]