osquery使用总结

一、测试环境

vmware centos7.0 4G内存  200G硬盘

192.168.72.238  host198
192.168.72.239  host199
192.168.72.240  host200

二、配置文件

vi /etc/osquery/osquery.conf  如下:

{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "logger_path": "/var/log/osquery",
    "pidfile": "/var/osquery/osquery.pidfile",
    "worker_threads": "2",
    "enable_monitor": "true"
  },

  "schedule": {
    "path1": {
      "query": "select 'file_metric' metric,path,type,blocks,blocks_free from mounts where type='xfs' and path='/' and blocks!=0;",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "path2": {
      "query": "select 'file_metric' metric,path,type,blocks,blocks_free from mounts where type='xfs' and path='/home' and blocks!=0;",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "path3": {
      "query": "select 'file_metric' metric,path,type,blocks,blocks_free from mounts where type='xfs' and path='/boot' and blocks!=0;",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "load1": {
      "query": "select 'file_metric' metric,path,type,blocks,blocks_free from mounts where type='xfs' and path='/boot' and blocks!=0;",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "load1": {
      "query": "select 'file_metric' metric,path,type,blocks,blocks_free from mounts where type='xfs' and path='/boot' and blocks!=0;",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "load1": {
      "query": "select 'load_metric' metric,period,average from load_average where period='1m';",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "load2": {
      "query": "select 'load_metric' metric,period,average from load_average where period='5m';",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "load3": {
      "query": "select 'load_metric' metric,period,average from load_average where period='15m';",
      "interval": 60,
      "removed": false,
      "snapshot": true
    },
    "memory": {
      "query": "select memory_total,memory_free,swap_cached,active from memory_info;",
      "interval": 60,
      "removed": false,
      "snapshot": true
    }
  },
  "decorators": {
    "always": [
      "select unix_time from time;"
    ]
  }
}

三、问题记录

1. 无法将内存、cpu、磁盘、负载监控集中输出至一条信息中。
2. 当采集的机器很多时，无法做排序，给肉眼(特傻的方法)测试，延迟较大(超过20s)。
3. 日志如何归档？

   优点：

      可以简单使用查询服务器内存、cpu、磁盘、负载信息。我个人常用的sql如下：     

select period,average from load_average;

select memory_total,memory_free,swap_cached,active from memory_info;

select path,type,blocks,blocks_free from mounts where blocks!=0;

四、参考资料

http://www.cnblogs.com/xuxinkun/tag/osquery/

转载于:https://my.oschina.net/100asker/blog/1541762