Struct OSQuery

pub struct OSQuery { /* private fields */ }

A Struct that handles osquery Thrif API comunication

Examples

use osquery_rs::OSQuery;

fn main () {
    let res = OSQuery::new()
            .set_socket("/home/root/.osquery/shell.em")
            .query(String::from("select * from time"))
            .unwrap();
    println!("{:#?}", res);
}

Implementations

impl OSQuery

pub fn new() -> Self

pub fn set_socket(self, path: &str) -> Self

Set the osquery Thrift API socket to be used for comunication with osquery service

pub fn set_timeout(self, timeout: u64) -> Self

Set osquery queries timeout in seconds (default 10 seconds)

pub fn get_timeout(&self) -> u64

Get osquery queries timeout in seconds

pub fn get_socket(&self) -> String

A getter for socket used for comunication

pub fn spawn_instance(self, path: &str) -> Result<Self>

Spawn an instance of osquery. This allows the use of osquery in system that does not have osquery installed (standalone)

Examples

use osquery_rs::OSQuery;

fn main() {
    let res = OSQuery::new()
        // Specify the path to the osquery binary
        .spawn_instance("./osqueryd")
        .unwrap()
        .query(String::from("select * from time"))
        .unwrap();
    println!("{:#?}", res);
}

pub fn query(&self, sql: String) -> Result<ExtensionResponse>

Execute an osquery SQL query and retrive the results

Trait Implementations

impl Drop for OSQuery

fn drop(&mut self)

Executes the destructor for this type.