Watching Your Fleet with OSQuery by James Carr

OSQuery is a pretty impressive tool that lets you query various facts about your operating system as if it was a database. You can query facts like packages installed, the versions, network details, processes, etc. You can even compose some joins to list processes that are listening on certain ports.

In this talk I'll go over using OSQuery on your personal machine as well as installing it on your server fleet and using scheduled queries to constantly watch what is happening on your boxes.