10 Pitfalls on The Path to Osquery Bliss

Examples and solutions for 10 common osquery problems.

1. User context when executing queries.
2. Order of tables in JOIN can be significant.
3. Large files and the --read_max flag.
4. JSON escaping and query packs.
5. CLI flags vs. configuration options.
6. Understanding schedule intervals.
7. Events in osqueryd and osqueryi.
8. Tuning event expiration flags.
9. Event publisher status.
10. Identifying expensive queries.

Download PDF