install linux

Installation

osquery supports several distributions of Linux.

For each supported distro, we supply vagrant infrastructure for creating native operating system packages.

To create a package (e.g. a deb on Ubuntu or an rpm on CentOS), simply spin up a vagrant instance.

For example:

vagrant up ubuntu14
vagrant ssh ubuntu14

Supported distributions are:

• ubuntu14
• ubuntu12
• centos

Once you have logged into the vagrant box, run the following to create a package:

cd /vagrant
sudo make deps
make
make package

Sub-components

Kernel instrumentation

osquery's first bit of linux kernel instrumentation consists of camb (pronounce CAM-bee), which is a kernel module that currently lives out-of-tree. The below steps at least work on modern versions of Ubuntu.

Build requirements:

1. Linux kernel headers
2. System.map file for a built kernel

Build steps:

1. git clone https://github.com/facebook/osquery.git
2. sudo apt-get install -y linux-headers-$(uname -r)
3. cd kernel/linux
4. sudo make SMAP=/boot/System.map-$(uname -r) KDIR=/lib/modules/$(uname -r)/build

Install steps:

1. sudo insmod camb.ko

Deployment

If you're interested in using osquery to monitor Linux servers in a production environment, see the deployment guide.