The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,569 other followers

Need to revisit osquery: SQL powered operating system instrumentation, monitoring, and analytics supports more platforms and also aggregates to central log locations

Posted by jpluimers on 2022/01/18

Almost two years ago, GitHub – facebook/osquery: SQL powered operating system instrumentation, monitoring, and analytics published from the automatic blog queue.

It was in the midst of my rectum cancer treatment, so I was glad the blog queue back then was still about 18 months deep.

This meant I looked into osquery in 2018, which I remember because I needed it on MacOS as I did not want to remember the syntax for MacOS specific commands on getting system information. It also coincides with how much my repository fork was behind: [Wayback: jpluimers/osquery commits/Archive: jpluimers/osquery commits].

Fast forward to now, the breath of systems I’m involved with has widened, so I was glad to see that Kristian Köhntopp mentioned it:

So time to try it again (:

The links he mentioned:

  • [Wayback/Archive] Welcome to osquery – osquery

    osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive.

  • [Wayback/Archive] Welcome to osquery – osquery: High Level Features
    The high-performance and low-footprint distributed host monitoring daemon, osqueryd, allows you to schedule queries to be executed across your entire infrastructure. The daemon takes care of aggregating the query results over time and generates logs which indicate state changes in your infrastructure. You can use this to maintain insight into the security, performance, configuration, and state of your entire infrastructure. osqueryd‘s logging can integrate into your internal log aggregation pipeline, regardless of your technology stack, via a robust plugin architecture.
    The interactive query console, osqueryi, gives you a SQL interface to try out new queries and explore your operating system. With the power of a complete SQL language and dozens of useful tables built-in, osqueryi is an invaluable tool when performing incident response, diagnosing a systems operations problem, troubleshooting a performance issue, etc.
  • [Wayback/Archive] osqueryd (daemon) – osquery
  • [Wayback/Archive] osqueryi (shell) – osquery
  • [Wayback/Archive] Aggregating Logs – osquery
  • [Wayback/Archive] AWS Logging – osquery

Main site: [Wayback/Archive] osquery | Easily ask questions about your Linux, Windows, and macOS infrastructure

Repository: [Wayback/Archive] osquery/osquery: SQL powered operating system instrumentation, monitoring, and analytics.

–jeroen

Posted in Software Development, Development, Power User, *nix, Infrastructure, SocialMedia, Apple, Windows, Mac OS X / OS X / MacOS, Mac, Facebook, *nix-tools, DevOps | Leave a Comment »

ESXi: persistent files you can edit to apply settings during boot

Posted by jpluimers on 2022/01/18

Since ESXi boots from RAM, most files in /etc are not persisted after modification.

The files that are persisted, are only persisted once every hour by auto-backup.sh, so better run auto-backup.sh by hand if you want to reboot after changing them.

The auto-backup.sh script is ran every hour at 1 minute past the hour as per below crontab.

Default ESXi crontab in /var/spool/cron/crontabs/root:

#min hour day mon dow command
1    1    *   *   *   /sbin/tmpwatch.py
1    *    *   *   *   /sbin/auto-backup.sh
0    *    *   *   *   /usr/lib/vmware/vmksummary/log-heartbeat.py
*/5  *    *   *   *   /bin/hostd-probe.sh ++group=host/vim/vmvisor/hostd-probe/stats/sh
00   1    *   *   *   localcli storage core device purge

Schedules deciphered via [Wayback] Crontab.guru – The cron schedule expression editor:

  • [Wayback] Every day at 01:01: “This module removes stale temporary files”
    1    1    *   *   *   /sbin/tmpwatch.py
  • [Wayback] Every hour at *:01: saves backup to /bootbank/state.tgz.
    1    *    *   *   *   /sbin/auto-backup.sh
  • [Wayback] Every hour at *:00 logs heartbeat messages to /var/log/vmksummary.log like 2021-02-23T19:00:02Z heartbeat: up 577d2h37m16s, 9 VMs; [[2802426 vmx 4194304kB] [6176344 vmx 4194304kB] [68997 vmx 8388608kB]] [[2802426 vmx 0%max] [6176344 vmx 0%max] [68997 vmx 0%max]]
    0    *    *   *   *   /usr/lib/vmware/vmksummary/log-heartbeat.py
  • [Wayback] Every 5th minute logs to /var/log/hostd-probe.log.
    */5  *    *   *   *   /bin/hostd-probe.sh ++group=host/vim/vmvisor/hostd-probe/stats/sh
  • [Wayback] Every day at 01:00: Removes storage devices which have not been seen in some time interval.
    00   1    *   *   *   localcli storage core device purge

Note that localcli commands are the same as esxcli; for esxcli, a running hostd is required; localcli can run without hostd. See:

–jeroen

Posted in Software Development, Development, Power User, *nix, VMware, Scripting, *nix-tools, Virtualization, ESXi6, ESXi6.5, ESXi6.7, ESXi7, ash/dash development, ash/dash | Leave a Comment »

A Redditor visits the iconic Windows XP “Bliss” hill in Microsoft Flight Simulator and recaptures the magic – NotebookCheck.net News

Posted by jpluimers on 2022/01/17

[Wayback] A Redditor visits the iconic Windows XP “Bliss” hill in Microsoft Flight Simulator and recaptures the magic – NotebookCheck.net News

XP:

2020:

Via: (note the wrong Windows version) [Archive.is] Stonehead on Twitter: “Zo ziet het Windows 95-bureaublad er tegenwoordig uit trouwens. Klimaatverandering is overal… “

–jeroen

Read the rest of this entry »

Posted in History, Power User, Windows, Windows XP | Leave a Comment »

ESXi ash/dash/busybox shell getting current timestamp in UTC ISO8601 format without colons or dashes

Posted by jpluimers on 2022/01/17

On VMware ESXi, with the  Busybox ash/dash shell, I wanted to get the current UTC timestamp in ISO 8601 format without dashes (-) or especially colons (:) and plus-signs (+) you have to back-slash escape colons or double quote parameters, which is often can be a pain).

This is why we can’t have good things: Getting the UTC 8610 timestamp was far less easy than I hoped for.

First of all, Busybox only allows for a precision of seconds, not milliseconds, and the specification format needs better documentation as per [Wayback] embedded linux – How to get ISO8601 seconds format from “date” in busybox? – Stack Overflow:

Read the rest of this entry »

Posted in *nix, *nix-tools, ash/dash, ash/dash development, Development, ESXi6, ESXi6.5, ESXi6.7, ESXi7, Power User, Scripting, sed, sed script, Software Development, Virtualization, VMware, VMware ESXi | Leave a Comment »

Streaming Setup, Iterated (reminder to self, as it might hold for other retro-hardware)

Posted by jpluimers on 2022/01/17

Sebastian Bergmann documented his Twitch streaming setup using digital output from his Amiga 1200 retrocomputing machine: [Wayback] Streaming Setup, Iterated

This might hold for other retro-hardware too, so here is the schema he uses:

[Wayback image]

–jeroen

Read the rest of this entry »

Posted in LifeHacker, Power User | Leave a Comment »

 
%d bloggers like this: