bk99.de entertain the web since 1997

bk99.de
HN · System diagnosticsCurated

Osquery makes operating system state queryable with SQL

Summary

Facebook releases osquery, which exposes processes, files, users, packages and kernel information as relational tables. Osquery was released at Facebook in 2014. The project supports Linux, macOS and Windows.

Ideas

  • Virtual tables translate operating system data into SQL rows.
  • A common query language unifies inventory and diagnostics.
  • Scheduled queries detect state changes on many machines.
  • Extensions add your own data sources and tables.

Insights

  • Familiar interfaces make system data accessible to more teams.
  • Uniform queries make fleet comparisons and forensic searches easier.
  • Observability needs secure distribution and limits on powerful queries.

Facts

  • The query engine is based on SQLite.

Recommendations

  • Keep important queries and their expected results under version control.
  • Restrict access to sensitive tables and logs.

References

Read the original article

Search the Web Archive

HN · 2020

Operating system development on the Raspberry Pi

Sergey Matyukevich uses executable lessons to lead from ARM64 boot code through interrupts and the scheduler to user space and virtual memory. The series uses a Raspberry Pi 3. The example kernel targets the ARM64 architecture.

HN · 2018

Operating system development on the Raspberry Pi

Sergey Matyukevich leads in lessons that build on each other from ARM64 boot code to interrupts, scheduler, user space and virtual memory. The project targets the Raspberry Pi 3 and ARM64. The lessons contain source code and explanations.

HN · 2015

System administration does not disappear with containers

Thomas Fricke criticises running containers without a solid understanding of Linux, networking, storage, security and fault analysis. The criticism refers to the early Docker boom. Linux remains the shared kernel of many containers.