Ben Chuanlong Du's Blog

It is never too late to learn.

Query and Monitor OS Information using osquery

Things on this page are fragmentary and immature notes/thoughts of the author. Please read with your own judgement!

  1. List all tables.

    .\osqueryi .tables

  2. Check the schema of a table (e.g., "process").

    .\osqueryi ".schema processes"

Querying System Information

.\osqueryi.exe "select * from system_info"

Querying Docker

Please refer to Manage …

The Best Way to Find Files and Manipulate Them

Things on this page are fragmentary and immature notes/thoughts of the author. Please read with your own judgement!

There are many cool (command-line) tools which can help you quickly find/locate files.

  1. find
  2. locate
  3. osquery
  4. fselect
  5. ripgrep

Those tools can be combined with the pipe operator | to do further filtering or manipulation. However, after trying all tools I have to state that the best way for a Python user is leveraging the pathlib