AlienVault® USM Anywhere™

Linux Log Collection with Osquery

Osquery is an operating system instrumentation framework for Linux that exposes this operating system as a high-performance relational database so that SQL queries can explore the operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events, or file hashes.

Note: If you are already using syslog, you do not need to run osquery.

To collect logs from Linux using osquery using a manual configuration

You must have sudoA program for UNIX-like computer operating systems that allows users to run programs with the security privileges of another user, by default the superuser. privileges to complete this procedure.

  1. If you do not yet have osquery, download it and follow the instructions appropriate for your operating system.
  2. Create a text file called osquery.conf and copy-paste the contents of this file into it.

    Important: After you copy-paste the text, make sure to edit it so that all strings with equals signs (=) in them remain on the same line. Otherwise, this procedure will fail.

  3. Save osquery.conf and copy it to /etc/osquery/.

    Note: We recommend leaving the queries created by default, but you can create your own osquery configuration.

  4. Start the osquery daemon:
  5. osqueryd --daemonize --config_path /etc/osquery/osquery.conf

  6. If you have not already done so, configure syslog to send data to the USM Anywhere Sensor. See Configure Syslog on Your Data Sources for instructions.

    This should include restarting the syslog service.

  7. Verify that you can see osquery events in USM Anywhere.

    Select the Osquery plugin to filter the Events page