feature request: setup module import osquery data

[3rdman]

It would be really nice to have the setup module import osquery data if osqueryi is present on the system.

The simple path is to:

for table in $(osqueryi .tables)
schema=osqueryi '.schema $table'
for row in select * from $table
add row to setup_options["osquery_"]
done

[rmetzler]

I think it would be beneficial to add an osqueryi module, so it would be easy to run ad hoc queries on a group of hosts.

Though, I disagree with doing a loop over all osquery tables in the setup module by default.

Nevertheless I would like to showcase a simple trick of integrating osquery selects into Ansible setup facts. By using the /etc/ansible/facts.d/ dir on the host machines, every host is able to provide local facts. The facts module will run all executables in the glob '*.fact' and will add the JSON returned from stdout to ansible_local.

This is a simple example

$ cat /etc/ansible/facts.d/osquery_etc_hosts.fact 
#!/usr/bin/env bash
osqueryi "SELECT * FROM etc_hosts;" --json

$ ansible localhost -m setup -a'filter=ansible_local'
localhost | SUCCESS => {
    "ansible_facts": {
        "ansible_local": {
            "osquery_etc_hosts": [
                {
                    "address": "127.0.0.1", 
                    "hostnames": "localhost"
                }, 
                {
                    "address": "255.255.255.255", 
                    "hostnames": "broadcasthost"
                }, 
                {
                    "address": "::1", 
                    "hostnames": "localhost"
                }, 
                {
                    "address": "fe80::1%lo0", 
                    "hostnames": "localhost"
                }, 
                {
                    "address": "127.0.0.1", 
                    "hostnames": "www.localhost"
                }
            ]
        }
    }, 
    "changed": false
}

[rmetzler]

Another workaround is using the shell modul and registering the output. Then you have to use set_fact like this. Please compare the debug messages to see the difference between the two variables:

- hosts: all
  tasks:
    - shell: osqueryi "SELECT * FROM etc_hosts" --json
      register: output
    - set_fact:
        osquery_etc_hosts: "{{ output.stdout }}"
    - debug: msg={{ osquery_etc_hosts }}
    - debug: msg={{ output }}

I also looked into how to create modules, and I think it would be easy to write a osqueryi_facts module.

[ansibot]

@3rdman Greetings! Thanks for taking the time to open this issue. In order for the community to handle your issue effectively, we need a bit more information.

Here are the items we could not find in your description:

• issue type
• ansible version
• component name

Please set the description of this issue with this template:
https://raw.githubusercontent.com/ansible/ansible/devel/.github/ISSUE_TEMPLATE.md

click here for bot help

[ansibotdev]

@3rdman You have not responded to information requests in this issue so we will assume it no longer affects you. If you are still interested in this, please create a new issue with the requested information.

click here for bot help