osquery

Question

在我的 linux 机器上使用 osquery（如果重要的话，CentOS 7）当运行每个使用 osqueryi 交互式 [=28= 的查询时，我得到关于迁移的自动详细信息输出].有没有什么办法可以quiet/hide这样的输出而return只有结果？

我有：

# osqueryi --json "SELECT * FROM memory_info";

I0228 15:39:12.077577  6039 database.cpp:563] Checking database version for migration
I0228 15:39:12.077644  6039 database.cpp:587] Performing migration: 0 -> 1
I0228 15:39:12.077657  6039 database.cpp:619] Migration 0 -> 1 successfully completed!
I0228 15:39:12.077663  6039 database.cpp:587] Performing migration: 1 -> 2
I0228 15:39:12.077672  6039 database.cpp:619] Migration 1 -> 2 successfully completed!

[{"active":"320831488","buffers":"2158592","cached":"379183104","inactive":"130363392","memory_free":"1393258496","memory_total":"1928024064","swap_cached":"0","swap_free":"1610608640","swap_total":"1610608640"}]

我想要的：

# osqueryi --json "SELECT * FROM memory_info";

[{"active":"320831488","buffers":"2158592","cached":"379183104","inactive":"130363392","memory_free":"1393258496","memory_total":"1928024064","swap_cached":"0","swap_free":"1610608640","swap_total":"1610608640"}]

Answer 1

您可以将 --logger_min_status 1 添加到命令行，但希望 https://github.com/facebook/osquery/pull/5530 应该默认修复此行为。

osquery - 删除每个 osqueryi 查询的详细迁移信息

osquery - removing verbose migration info on every osqueryi query

我有：

我想要的：