Skip to content

1.4.0

Choose a tag to compare

View all tags
@theopolis theopolis released this 09 Feb 23:33
· 5455 commits to master since this release
1.4.0
94f97b9

New features in 1.4:

  • Extensions Thrift API
  • osqueryd "worker" performance monitoring
  • Filesystem QueryContext wildcards

Potential API incompatibility changes:

Removed column name (TEXT) from table process_envs
Removed column path (TEXT) from table process_envs

Config options / CLI flags changes:

--config_retriever renamed --config_plugin
--config_check will check the config parsing status and exit
--event_pubsub=true renamed --disable_events=false
--disable_watchdog=false controls the osqueryd worker process usage
--extensions_socket=/var/osquery/osquery.em added
--force=false if set will attempt to kill previously running osqueryd daemons
--log_receiver renamed --logger_plugin
--watchdog_level=1 controls the acceptable performance impact of osqueryd workers

Additional API changes:

Added table block_devices to All Platforms
Added table kernel_info to All Platforms
Added table xattr_where_from to Darwin (Apple OS X)
Added table memory_map to Ubuntu, CentOS
Added table process_memory_map to Ubuntu, CentOS
Added table shared_memory to Ubuntu, CentOS
Added column atime (BIGINT) to table file
Added column block_size (INTEGER) to table file
Added column ctime (BIGINT) to table file
Added column device (BIGINT) to table file
Added column gid (BIGINT) to table file
Added column hard_links (INTEGER) to table file
Added column inode (BIGINT) to table file
Added column is_block (INTEGER) to table file
Added column is_char (INTEGER) to table file
Added column mode (TEXT) to table file
Added column mtime (BIGINT) to table file
Added column size (BIGINT) to table file
Added column uid (BIGINT) to table file
Removed table block_devices from Ubuntu, CentOS

Assets 2
Loading