インストール方法
以下のコマンドを実行しますwget https://pkg.osquery.io/rpm/osquery-4.7.0-1.linux.x86_64.rpm
sudo rpm -i osquery-4.7.0-1.linux.x86_64.rpm
・サンプル実行
sudo osqueryi "select * from device_partitions where device = '/dev/sda'"
+----------+-----------+-------------------------------------+-------------+------------+-------------+-----------+--------+-------+
| device | partition | label | type | offset | blocks_size | blocks | inodes | flags |
+----------+-----------+-------------------------------------+-------------+------------+-------------+-----------+--------+-------+
| /dev/sda | 0 | Primary Table (#0) | meta | 0 | 512 | 1 | -1 | 4 |
| /dev/sda | 1 | Unallocated | unallocated | 0 | 512 | 2048 | -1 | 2 |
| /dev/sda | 2 | Linux (0x83) | normal | 1048576 | 512 | 2097152 | -1 | 1 |
| /dev/sda | 3 | Linux Logical Volume Manager (0x8e) | normal | 1074790400 | 512 | 165672960 | -1 | 1 |
+----------+-----------+-------------------------------------+-------------+------------+-------------+-----------+--------+-------+
0 件のコメント:
コメントを投稿