Facebook open sources project that lets you view your OS as a relational database

jeremy · 10-29-2014, 04:12 PM

Quote:

On Wednesday, Facebook said it is open sourcing a software framework called osquery that lets users see their operating system as a relational database, supposedly making it easier for them to learn how their OS is functioning.

Using osquery, common operating system characteristics like running processes, drivers and open network connections can be viewed as SQL tables, which allows users to run SQL queries on them to discover potential problems and troubleshoot errors.

You can even use osquery as a security tool to help discover malicious activity lurking about in your OS. For example, you can run a custom SQL query that displays all of the running processes on your OS that originally launched from a binary that doesn’t exist on your OS filesystem — a common trait of shady processes.

The social networking giant also created some handy tools (also part of the open-source release) based from the osquery framework that can help users learn about their OS performance. The osqueryi query console works as an SQL interface for users to experiment with queries and the host-monitoring daemon osqueryd lets folks schedule those queries.

From the Facebook blog:

The daemon takes care of aggregating the query results over time, and generates logs which indicate state changes in your infrastructure. You can use this to maintain insight into the security, performance, configuration and state of your entire infrastructure. Osqueryd’s logging can integrate into your existing internal log aggregation pipeline, regardless of your technology stack, via a robust plugin architecture.

More at Gigaom...

Looks interesting; do any LQ members have thoughts on this or plan on using it?

--jeremy