CentOS 7 安装osquery监控系统

osquery 简介

• osquery是一个SQL驱动操作系统检测和分析工具。osquery支持像SQL语句一样查询系统的各项指标，可以用于OSX和Linux操作系统。它使得底层操作系统分析和监控性能更加直观
• 项目主页：http://osquery.io/
• 代码托管地址：https://github.com/facebook/osquer
  

osquery 安装

[root@linuxprobe~]# yum -y install https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm
[root@linuxprobe~]# yum -y install osquery 

osquery 使用文档： https://osquery.io/docs/tables/

# 使用例子
# run osquery shell
[root@linuxprobe~]# osqueryi
osquery - being built, with love, at Facebook
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Using a virtual database. Need help, type '.help'
osquery> 
# show all column of tables for OS version
osquery> select * from os_version; 
+--------------+----------+-------+-------+-------+-------+----------+---------------+----------+
| name         | version  | major | minor | patch | build | platform | platform_like | codename |
+--------------+----------+-------+-------+-------+-------+----------+---------------+----------+
| CentOS Linux | 7 (Core) | 7     |       |       |       | centos   | rhel fedora   |          |
+--------------+----------+-------+-------+-------+-------+----------+---------------+----------+

# show some column of tables for System info
osquery> select hostname, cpu_brand, hardware_vendor, hardware_model from system_info; 
+----------------+-----------------------------------------+-----------------+-------------------------+
| hostname       | cpu_brand                               | hardware_vendor | hardware_model          |
+----------------+-----------------------------------------+-----------------+-------------------------+
| linuxprobe.org | Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz | VMware, Inc.    | VMware Virtual Platform |
+----------------+-----------------------------------------+-----------------+-------------------------+

# show some column of tables and also specify over 1000 of UID for User info
osquery> select uid, gid, username, shell from users where uid >= 1000; 
+-------+-------+-----------+---------------+
| uid   | gid   | username  | shell         |
+-------+-------+-----------+---------------+
| 1000  | 1000  | shaon     | /bin/bash     |
| 1001  | 1001  | wang      | /bin/bash     |
| 65534 | 65534 | nfsnobody | /sbin/nologin |
+-------+-------+-----------+---------------+

# show all column of tables for CPU Time
osquery> select * from cpu_time; 
+------+------+------+--------+-------+--------+-----+---------+-------+-------+------------+
| core | user | nice | system | idle  | iowait | irq | softirq | steal | guest | guest_nice |
+------+------+------+--------+-------+--------+-----+---------+-------+-------+------------+
| 0    | 912  | 0    | 3679   | 54015 | 2149   | 0   | 157     | 0     | 0     | 0          |
+------+------+------+--------+-------+--------+-----+---------+-------+-------+------------+

# to quit shell, push Ctrl+D 
osquery> 

定时监控设置

• 创建osquery配置文件

 [root@linuxprobe~]# vi /etc/osquery/osquery.conf
# create new
{
  "options": {
    // select the osquery config plugin (filesystem is default)
    "config_plugin": "filesystem",

    // select the osquery logging plugin (filesystem is default)
    "logger_plugin": "filesystem",

    // the PATH of log direcroty
    "logger_path": "/var/log/osquery",

    // PID file of the daemon
    "pidfile": "/var/osquery/osquery.pidfile",

    // the number of threads for concurrent query
    "worker_threads": "2",

    // enable schedule profiling
    // if adding a query "select * from osquery_schedule" in schedule section,
    // it's possible to record the performances
    "enable_monitor": "true"
  },

  "schedule": {
    // for example, get CPU Time per 300 seconds
    "cpu_time": {
      "query": "SELECT * FROM cpu_time;",
      "interval": 300
    },
    // for example, get settings of resolv.conf per an hour
    "dns_resolvers": {
      "query": "SELECT * FROM dns_resolvers;",
      "interval": 3600
    }
  },

   "packs": {
     // possible to include other configration files
     "hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf"
   }
}

• 启动osquery

[root@linuxprobe ~]# systemctl start osqueryd 
[root@linuxprobe ~]#  systemctl enable osqueryd 
Created symlink from /etc/systemd/system/multi-user.target.wants/osqueryd.service to /usr/lib/systemd/system/osqueryd.service.

• 查看osquery日志

[root@linuxprobe osquery]# less /var/log/osquery/osqueryd.results.log