Docs on running queries within subprocess/calling osqueryi from python

[arubdesu]

Pardon if this is the wrong place to open this issue. So far I can't figure out how to call osqueryi from within a python script, which I'm not sure if this module would help with after seeing #11. example:

cmd = ['/usr/local/bin/osqueryi', '--csv', '"select name, path from kernel_extensions"']
proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
list_with_pipes = proc.communicate()[0]
print list_with_pipes

Without setting shell=True I get a syntax error, but even with that, or using subprocess.check_output, I'm just getting an empty string. Halp?

[arubdesu]

I was being dumb, but as usual, being dumb in public can be instructive to similarly soft-minded folks. I needed to pull the extra pair of double-quotes, thanks to folks in the macadmins slack for pointing me in the right direction.
It should have been clearer to me that this is more about getting stuff into the osquery model than out.

[marpaia]

Shelling out and creating a new osqueryi process for every query is not necessary or preferable:

$ sudo python
Python 2.7.6 (default, Sep  9 2014, 15:04:36)
[GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.39)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import osquery
>>> client = osquery.ExtensionClient()
>>> client.open()
>>> client.extension_client().query("select * from time")
ExtensionResponse(status=ExtensionStatus(message='OK', code=0, uuid=0), response=[{'hour': '11', 'seconds': '31', 'timestamp': 'Tue Aug 25 18:55:31 2015 UTC', 'unix_time': '1440528931', 'month': '8', 'weekday': 'Tuesday', 'year': '2015', 'iso_8601': '2015-08-25T18:55:31Z', 'minutes': '55', 'day': '25'}])
>>>

[arubdesu]

Erm, but I'd need the osquery-python pkg installed for that to work out on my fleet, yes?

[marpaia]

Not really, if you just wanted to use the thrift API, you'd just need to speak to the thrift API. If you wanted to use the osquery-python api to communicate with osquery in your fleet, to make the UX a little better, then yeah, you'd obviously need the code on your systems.

[marpaia]

Added 33c1d31 to have an example on deck