A 'universal' Linux package can be created for each package distribution system. These packages contain the osquery daemon, shell, example configuration and startup scripts. Note that the /etc/init.d/osqueryd script does not automatically start the daemon until a configuration file is created.

Each osquery tag (stable release) is published to yum and apt repositories for our supported operating systems: https://osquery.io/downloads.

The default packages create the following structure:

  1. /etc/osquery/
  2. /usr/share/osquery/osquery.example.conf
  3. /usr/share/osquery/lenses/{*}.aug
  4. /usr/share/osquery/packs/{*}.conf
  5. /var/log/osquery/
  6. /usr/lib/osquery/
  7. /usr/bin/osqueryctl
  8. /usr/bin/osqueryd
  9. /usr/bin/osqueryi

Installing osquery

To install osquery follow the instructions on the Downloads page according to your distro.

Running osquery

To start a standalone osquery use: osqueryi. This does not need a server or service. All the table implementations are included!

After exploring the rest of the documentation you should understand the basics of configuration and logging. These and most other concepts apply to the osqueryd, the daemon, tool. To start the daemon:

  1. sudo cp /usr/share/osquery/osquery.example.conf /etc/osquery/osquery.conf
  2. # sudo service osqueryd start
  3. sudo systemctl start osqueryd

NOTICE: The interactive shell and daemon do NOT communicate!