Commit Graph

266 Commits

Author SHA1 Message Date
Stefano Bonicatti
1463d0a76e Add make to be installed among the other packages on Linux (#5784)
Also use --no-install-recommends to avoid installing unneeded packages.
2019-09-12 13:24:09 -04:00
Mike Myers
802e667d85 Readthedocs cleanup (#5767)
* Update HTTP links to HTTPS links, point to current URIs, update test-running steps.
* Clarify a minor missing cd step in the shell commands; minor format fixes.
* Add a note about how to isolate individual unit tests, using GTEST_FILTER.
* Drop first-person voice in docs/wiki/deployment/debugging.md.
* Document that osqueryd -S == osqueryi.
* Add new build steps for Linux using the custom toolchain.

Co-Authored-By: seph <github@directionless.org>
2019-09-08 11:59:18 -04:00
Stefano Bonicatti
0b2cd791d3 Linux custom toolchain integration (#5759)
- Always link to libc++abi.a, dl and rt.
- Add OSQUERY_TOOLCHAIN_SYSROOT option which should contain
  the path to the sysroot where the portable compiler and its libraries are in.
- Fix OpenSSL build with custom toolchain.
- Always include the custom toolchain cmake.
  Unfortunately system name detection is done when project() is called
  which is also when compiler detection is done, and we need the compiler
  to be set before that, so we always include the cmake file.
- Do not use getrandom syscall in Boost, for glibc < 2.25 support.
- Remove usage of secure_getenv and getauxval in librpm.
- Update CI to use the toolchain.
- Reflect changes in the docs.
2019-09-06 19:51:25 -04:00
Stefano Bonicatti
f6ed617394
Uniform and update CMake version to 3.14.6 (#5756)
The new version contains a fix for the FindBison module.
The docs have been updated too.
2019-09-06 22:12:13 +02:00
Mike Myers
3b584c62b1 Address issue #5681 with more complete info on extension file permissions. (#5741) 2019-09-04 08:11:45 -04:00
Mike Myers
ecd9e2340b Add note on the need for Administrator when building on Windows (#5740)
... and additional prerequisites on Ubuntu 18.10.
2019-09-03 13:56:18 -04:00
Mike Myers
c34be8e546 Correct for 3.4.0 change to install path; copy-edit; add steps for MSI packaging with CMake. 2019-08-28 12:56:38 -04:00
Teddy Reed
2e8016a038 docs: Update README to correct email and build guide 2019-08-23 00:57:21 -04:00
Mike Myers
9541378a8f Make improvements to the bulid guide. 2019-08-23 00:55:09 -04:00
Teddy Reed
a56b43eb1d
docs: Update ReadTheDocs with new build docs (#5708) 2019-08-21 21:27:00 -04:00
seph
7a96a9660e sql function regex_match (and some tests for other sql functions) (#5444) 2019-08-14 11:51:21 -04:00
seph
debf92d943
Fix link in docs (#5666)
Update the hyperlink to tables.ht in the docs.
2019-07-24 21:19:33 -07:00
Nick Anderson
214302bdeb
windows: updating more references to osquery installation path (#5580) 2019-06-05 12:45:40 -07:00
George Guliashvili
758706331f Remove unused flag enable_monitor
Summary: Removing flag which was declared but never used. enable_monitor

Reviewed By: marekcirkos

Differential Revision: D13958265

fbshipit-source-id: 3a812330950b101abdbd83ada4afd5b262cabd26
2019-02-07 08:16:00 -08:00
bransmartUK
9edcde9083 Added function examples to documentation, SQL Additions (#5305)
Summary:
This pull request is for the addition of examples under the functions in the SQL Additions sub title in the documentation. Specifically the introduction section of the documentation. The file that was changed was sql.md in the osquery/docs/wiki/introduction path. This is the addition I made:

- Added a minimalist drop down design under every subsection of new functions added. (ex. Math Functions like 'sqrt', 'log', ect.). This will allow for newcomers to the documentation to understand even deeper the new Sql added functions that the osquery team supplied, and how to use them in the actual program.

- Each added example tackles every function the osquery team listed in the documentation. Allowing for closer understanding of the functions.
Pull Request resolved: https://github.com/facebook/osquery/pull/5305

Reviewed By: guliashvili

Differential Revision: D13693267

Pulled By: fmanco

fbshipit-source-id: 9c3cd5b5950ce019f5ea5fc74f780f50a291ca71
2019-01-16 14:57:12 -08:00
ume
e72d28797d Fix config_name typo on documentation (#5243)
Summary:
* I think watchlog is a typo for watchdog.
* watchlog_level=2 is legacy configuration.
    * https://github.com/facebook/osquery/pull/2173
Pull Request resolved: https://github.com/facebook/osquery/pull/5243

Reviewed By: guliashvili

Differential Revision: D13693315

Pulled By: fmanco

fbshipit-source-id: 626545186e3950eb43226f6d3926581482d92458
2019-01-16 09:26:14 -08:00
Robbie Ostrow
6b62ce1d8b remove heroku's windmill project from remote deployment doc (#5283)
Summary:
Heroku's windmill project seems to have been removed from both Github and Heroku's site. This PR just deletes the paragraph referring to Windmill (and also deletes a space that was causing markdown to render **https://** incorrectly.)
Pull Request resolved: https://github.com/facebook/osquery/pull/5283

Differential Revision: D13625435

Pulled By: fmanco

fbshipit-source-id: 32e97f8db39d705924a6841b53f0d018e76ddb71
2019-01-11 05:56:57 -08:00
Jonathan Keljo
068efc9d67 Generate strongly-typed TableRow subclasses for each table
Summary:
Continuing to march toward low-overhead, type-safe table rows, this commit
introduces the code generation for said rows. Nothing uses it yet; see the
next commit for that.

(Adapted from https://github.com/facebook/osquery/pull/5199)

Reviewed By: guliashvili

Differential Revision: D13438017

fbshipit-source-id: 959a6e092aee38d33e1c6539cbe14b85172c0135
2019-01-09 13:50:15 -08:00
divious1
a61add8bdd splunk is moving towards preferring colons in sourcetype delimiters (#5338)
Summary:
Just a minor cosmetic change on docs, that changes the Splunk's sourcetype names to have colons instead of underscore as it is the preferred method for delimiting sourcetypes. Not sure if a test is needed for this actual docs change.
Pull Request resolved: https://github.com/facebook/osquery/pull/5338

Differential Revision: D13607572

Pulled By: fmanco

fbshipit-source-id: 95f255fb91b821b602a89c9dda3501fdba10fd1b
2019-01-09 09:47:57 -08:00
George Guliashvili
971bee4441 Move build system to BUCK
fbshipit-source-id: 8ffef5e6a393ac67ce56dcb74845402e43d964a0
2018-12-07 16:12:35 +00:00
ThorodanBrom
805d53e44a Update process-auditing.md (#5188) 2018-09-07 13:04:49 +01:00
ThorodanBrom
3229743460 Small doc fixes (#5186) 2018-09-06 19:42:11 +01:00
Mathieu Martin
c7803fdefd Fix typo. It's Comma, not Coma :-) (#5151) 2018-08-30 21:42:13 +01:00
Giorgi Guliashvili
fa98cd5cc6
get rid of aliased flag log_result_events (#4970) 2018-08-20 20:42:40 +01:00
Giorgi Guliashvili
b30af3b6f2
remove primary logger concept (#4969) 2018-08-20 20:38:26 +01:00
ryandeivert
68be4f10fa [aws] adding aws proxy support in ClientConfiguration (#4850) 2018-08-17 10:25:10 +01:00
Filipe Manco
62cadb1661
Update linux installation guide (#4968) 2018-08-16 18:28:45 +01:00
Adrien Schildknecht
78eb9d4ce1 docs: fix the definition of 'posix' for the platform key (#4899) 2018-08-13 16:53:12 +01:00
Mike Myers
2b1e8eaf88 Improve extensions documentation (#4761) 2018-08-11 12:36:18 -04:00
Alexander
95e5dc7ebb
Use pre-aggregation cache for all records flowing thru numeric monitoring system (#4690)
PR based on #4677 , have a look on it firstly.
2018-07-17 09:31:51 +01:00
Allan Liu
8f4529d2a3 General SMART drive information virtual table (#4133) 2018-07-13 09:51:55 -04:00
Vova Mishatkin
dbac4ea67c
Add the ability to specify file_paths with sql queries (#4678) 2018-07-10 16:24:13 +01:00
Filipe Manco
9197810c76
Fix documentation for flag decorations_top_level (#4688) 2018-07-10 14:04:10 +01:00
Jonathan Keljo
f088f26c61 Add documentation for conditional column gen (#4673) 2018-07-08 10:10:42 -04:00
Kolokotronis Panagiotis
4270f75b94 Kafka logging plugin is called kafka_producer (#4594) 2018-06-23 12:01:27 +01:00
Chris Long
5ee495504f docs: Updating process auditing documentation (#4477) 2018-06-19 01:51:55 -04:00
Max Kareta
408c54565e
Removing macOS kernel module (#4572) 2018-06-17 19:21:07 +01:00
Alexander
18f46707fe
actualize names for *base64* family functions (#4568)
Issue: #4563
2018-06-15 11:37:01 +01:00
Daniel Roethlisberger
d326597756 MAC framework is not a supported KPI (#4484) 2018-06-04 11:04:49 -07:00
Nick Anderson
c7e571e5c3
docs: adding note about extensions using RJ (#4480) 2018-06-02 22:37:03 -07:00
Alessandro Gario
5006a02c27 Bundle C++ extensions into a single executable (#4335) 2018-06-03 02:04:36 +01:00
Brian Beyer
c4410d6d74 Fix typo in example (#4472) 2018-06-01 18:37:34 -07:00
Jeff Pace
2eadac3cc1 Updated documentation links back to the osquery website. (#4451) 2018-06-01 00:08:33 -07:00
Scott Lundgren
89fe2dc693 update building documentation to reference Windows (#4389) 2018-05-16 23:36:11 -04:00
Mohamed Bassem
fa96157301 Fixing OSQUERY_DEPS in building documentation (#4390) 2018-05-15 11:48:36 +01:00
Teddy Reed
6e9f55d15d
llvm 6.0 and libFuzzer implementation (#4370) 2018-05-12 21:56:00 -04:00
cankansin
122b3867bd wrong variable name, content should be config (#4385) 2018-05-12 10:23:41 -07:00
Eitan Adler
cbb22c887f Remove extraneous letter from CLI flags (#4334) 2018-04-27 14:14:57 -07:00
Seshu Pasam
e45ddd98ce kafka: Support for kafka compression.codec (#4181) 2018-03-21 11:53:13 -07:00
Mitchell Grenier
26bd32687a
Add block on short-circuiting discovery queries (#4170) 2018-03-05 13:00:54 -08:00