osqueryd schedules: turn a question into fleet telemetry

From shell to daemon

osqueryd runs the same SQL on an interval and writes results to a log. By default each scheduled query is differential: the first run logs everything, and later runs log only rows that were added or removed. A new listening port on one laptop shows as one line, not a full dump every hour.

A small configuration

The configuration is JSON. Each entry names a query and an interval in seconds. Keep intervals coarse for heavy tables; hashing every file hourly will be noticed by users.

{
  "options": { "logger_plugin": "filesystem", "logger_path": "/var/log/osquery" },
  "schedule": {
    "net_listeners": {
      "query": "SELECT p.name, p.path, l.port, l.address FROM listening_ports l JOIN processes p USING (pid) WHERE l.port != 0;",
      "interval": 900
    },
    "cron_entries": { "query": "SELECT command, path FROM crontab;", "interval": 3600 }
  }
}

osqueryctl config-check
sudo systemctl restart osqueryd

A differential result line

action is added or removed. hostIdentifier and unixTime place the change; columns hold the row.

{"name":"net_listeners","hostIdentifier":"lab-web-02",
 "calendarTime":"Mon Nov  2 14:15:03 2026 UTC","unixTime":1793628903,
 "action":"added",
 "columns":{"name":"socat","path":"/usr/bin/socat","port":"4444","address":"0.0.0.0"}}

Worked case: alerting on additions only

The log shipper forwards /var/log/osquery/osqueryd.results.log to the SIEM. A detection fires on net_listeners rows with action added where the path is not in the approved software list. In the lab fleet of twelve hosts, the first week produces three alerts: two from a developer tool and one planted socat listener. The developer tool is added to the allow list with an owner name.

Fleet managers such as FleetDM or Kolide distribute the same configuration and collect results centrally; the queries do not change.