fleet/schema/tables/apfs_physical_stores.yml

46 lines
1.7 KiB
YAML
Raw Normal View History

name: apfs_physical_stores
platforms:
- darwin
description: Information about APFS physical stores from the `diskutil apfs list -plist` command.
columns:
- name: container_uuid
type: text
required: false
description: The UUID of the APFS Contianer
- name: container_designated_physical_store
type: text
required: false
description: |
The disk displayed as the backing store of the container. There may be multiple,
use `apfs_physical_stores` to see all actual physical stores
- name: container_reference
type: text
required: false
description: The current reference for the APFS container, e.g. "disk3"
- name: container_fusion
type: text
required: false
description: Whether this container is on a "fusion drive" (i.e. SSHD)
- name: container_capacity_ceiling
type: bigint
required: false
description: The total amount of space in the container
- name: container_capacity_free
type: bigint
required: false
description: The amount of remaining free space in the container
- name: uuid
type: text
required: false
description: The UUID of the physical store
- name: identifier
type: text
required: false
description: The current identifier of the physical store (e.g. disk1s2)
- name: size
type: bigint
required: false
description: The size of the physical store in byptes
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false