[root@test-server ~]# yum-config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
Loaded plugins: fastestmirror
adding repo from: https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
grabbing file https://pkg.osquery.io/rpm/osquery-s3-rpm.repo to /etc/yum.repos.d/osquery-s3-rpm.repo
repo saved to /etc/yum.repos.d/osquery-s3-rpm.repo
[root@test-server ~]# yum-config-manager --enable osquery-s3-rpm
Loaded plugins: fastestmirror
[root@test-server ~]# yum install osquery
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: ftp.iij.ad.jp
* extras: ftp.iij.ad.jp
* updates: ftp.iij.ad.jp
Resolving Dependencies
--> Running transaction check
---> Package osquery.x86_64 0:3.2.6-1.linux will be installed
--> Finished Dependency Resolution
Dependencies Resolved
==============================================================================================================
Package Arch Version Repository Size
==============================================================================================================
Installing:
osquery x86_64 3.2.6-1.linux osquery-s3-rpm-repo 8.0 M
Transaction Summary
==============================================================================================================
Install 1 Package
Total size: 8.0 M
Installed size: 23 M
Is this ok [y/d/N]: y
Downloading packages:
warning: /var/cache/yum/x86_64/7/osquery-s3-rpm-repo/packages/osquery-3.2.6-1.linux.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID c9d8b80b: NOKEY
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
Importing GPG key 0xC9D8B80B:
Userid : "osquery (osquery) <osquery@fb.com>"
Fingerprint: 1484 120a c4e9 f8a1 a577 aeee 97a8 0c63 c9d8 b80b
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
Is this ok [y/N]: y
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : osquery-3.2.6-1.linux.x86_64 1/1
Verifying : osquery-3.2.6-1.linux.x86_64 1/1
Installed:
osquery.x86_64 0:3.2.6-1.linux
Complete!
[root@test-server ~]#
Osqueryを試してみる
インストールが完了したらOsqueryを試してみたいと思います。
Osqueryを試すには「osqueryi」ユーティリティを起動し、
対話モードで試してみることをオススメします。
osqueryi 試しにOSのバージョン「os_version」テーブルで確認してみましょう。
[root@test-server ~]# osqueryi
Using a virtual database. Need help, type '.help'
osquery> select name, version, patch, platform from os_version;
+--------------+--------------------------------------+-------+----------+
| name | version | patch | platform |
+--------------+--------------------------------------+-------+----------+
| CentOS Linux | CentOS Linux release 7.2.1511 (Core) | 1511 | rhel |
+--------------+--------------------------------------+-------+----------+
