Contents
osquery presents the operating system as a set of database tables. You can look up running processes or listening ports with an ordinary SQL SELECT statement.
This review is for people who want to check the state of their own computer or start monitoring endpoints. After reading it, you can do the following:
- Start
osqueryiand look up the available tables and their columns - List listening ports and the processes that opened them
- Check startup items and local users
What osquery is for
In osquery, processes, loaded kernel modules, network connections, browser plugins, file hashes, and more are exposed as SQL tables. The full list is on the official schema page. osquery runs on Linux, macOS, and Windows.
There are two ways to run it.
| osqueryi | osqueryd | |
|---|---|---|
| What it is | An interactive shell | A daemon (service) that keeps running |
| When to use it | Ad hoc queries and prototyping queries | Running queries on a schedule and logging changes |
| Administrator rights | Not required (some tables return fewer results) | Required to register it as a service |
The two do not talk to each other. osqueryi is standalone and needs no daemon or server.
Try it safely with osqueryi on your own computer
osqueryi only reads data and sends nothing out. Start on your own computer.
- Get the package for your operating system from the official downloads page and install it. On Windows you can also use Chocolatey. Linux has official yum and apt repositories, and macOS has a
.pkginstaller. - Run
osqueryiin a terminal (PowerShell on Windows). When you see theosquery>prompt, you are ready. - Type
.tablesto list the tables, and.schema listening_portsto show that table’s columns. - Paste one of the queries from the next section and run it. End each SQL statement with
;. - Type
.exitwhen you are done.
It works without administrator rights. Some information, such as other users’ processes, may be missing from the results.
Common queries
These queries are useful for defensive checks. The table and column names come from the official table specs.
| What you want to check | Query |
|---|---|
| Ports listening on all addresses, and their processes | SELECT DISTINCT processes.name, listening_ports.port, processes.pid FROM listening_ports JOIN processes USING (pid) WHERE listening_ports.address = '0.0.0.0'; |
| Programs that start automatically | SELECT name, path, source, status FROM startup_items; |
| Local users | SELECT uid, username, directory, shell FROM users; |
To get JSON output, pass the query as an argument, for example osqueryi --json "SELECT * FROM users".
Column values differ by operating system. For example, status in startup_items is enabled or disabled on Linux, and a combination of other values on macOS. When in doubt, check with .schema.
Running it as a daemon across many machines
osqueryd runs the queries in its configuration file at a set interval in seconds. It logs only the rows that were added or removed since the previous run. For example, if you list USB devices every 60 seconds, inserting a new USB stick leaves a record.
By default, configuration and logs use local files. To manage many machines, you can point osquery at a remote server over TLS. The official README lists fleet managers such as Fleet, Kolide, OSCTRL, and Zentral, and notes that the osquery project does not endorse, recommend, or test them.
Wazuh has an osquery module. It lets Wazuh agents manage the osquery configuration and collect its results.
Cautions
- Install and query osquery on other people’s machines only with permission from the owner or administrator.
- Results include user names, running command lines, and file locations. Check them before sharing.
- When you run it as a Windows service, make sure regular users cannot write to
osqueryd.exeor its folder. The official docs ask that only the Administrators group or SYSTEM have write access. - osquery is dual-licensed under Apache-2.0 and GPL-2.0, and you can choose either.
- osquery started at Facebook. In 2019, the Linux Foundation announced plans to form a foundation for it. We could not confirm the current governance details on the official site.
Read next
Sources
- Official repository (README)github.com/osquery/osquery
- LICENSEgithub.com/osquery/osquery/blob/master/LICENSE
- Docs: osqueryi (shell)osquery.readthedocs.io/en/latest/introduction/using-osqueryi/
- Docs: osqueryd (daemon)osquery.readthedocs.io/en/latest/introduction/using-osqueryd/
- Docs: Install on Windowsosquery.readthedocs.io/en/latest/installation/install-windows/
- Docs: Install on macOSosquery.readthedocs.io/en/latest/installation/install-macos/
- Docs: Install on Linuxosquery.readthedocs.io/en/latest/installation/install-linux/
- Docs: Remote settingsosquery.readthedocs.io/en/latest/deployment/remote/
- Table spec: listening_portsgithub.com/osquery/osquery/blob/master/specs/listening_ports.table
- Table spec: startup_itemsgithub.com/osquery/osquery/blob/master/specs/startup_items.table
- Linux Foundation: Intent to form a foundation for osquery (2019)www.linuxfoundation.org/press/press-release/the-linux-foundation-announces-intent-to-form-new-foundation-to-support-osquery-community
- Wazuh docs: Osquery moduledocumentation.wazuh.com/current/user-manual/capabilities/system-inventory/osquery.html
Checked on 2026-10-25
Similar tools
Wazuh
Impact Local onlyA free security platform (SIEM/XDR) that collects logs, configuration, and vulnerability data from agents on your endpoints and shows it all in one dashboard.
- Purpose
- Defense
- Type
- Self-hosted server
- Difficulty
- Advanced
- License
- CopyleftGPL-2.0（一部の構成要素は Apache-2.0）
- Category
- Vulnerability scanning / Forensics