For release notes please visit https://github.com/facebook/osquery/releases.

Build osquery

To take advantage of the most current features and join the osquery development community we like to suggest building from source! Head to GitHub clone and compile.

$ git clone http://github.com/facebook/osquery.git
$ cd osquery
$ make deps
$ make -j 8
$ ./build/<platform>/osquery/osqueryi

Install or package

With a working build you may install or create OS-specific packages for deployment. Using the recommended osquery-provided vagrant build environments and the build steps your packages should be as portable as possible.

# make install # optional
$ make packages
[...]
[+] package created at ./build/linux/osquery-XYZ.rpm


 OS X Package

You can download a pre-built osquery package that contains the binaries, LaunchDaemon, and example configurations. There are no package or library dependencies needed.

osquery-2.3.3.pkg


sha256: 7ce3d5fece9a58d4b02dcf1942aa52ee15445939b6ccc008b689836da5547f65

Install with brew

The community publishes an OS X homebrew every other week. Installing using brew is not officially supported since we cannot strictly control the build or library dependency builds.

$ brew update
$ brew install osquery
$ /usr/local/bin/osqueryi

Install yum repository

We publish osquery in a yum repository for CentOS/RHEL 6.3-6.6 and 7.0 built from our Jenkins build hosts. You may install the "auto-repo-add" RPM or add the repository target:

CentOS/RHEL 7.0

$ sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm
$ sudo yum install osquery

CentOS/RHEL 6.6

$ sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos6/noarch/osquery-s3-centos6-repo-1-0.0.noarch.rpm
$ sudo yum install osquery

CentOS/RHEL RPM

You may also download a pre-built osquery RPM that contains the binaries, an init.d script, and example configurations. There are very few package dependencies needed on CentOS/RHEL 6.6 and 7.0.

CentOS/RHEL 7.0

centos7/osquery-2.3.2-1.el7.x86_64.rpm


sha256: 1b1c3a5e356d22231f1e1a92eb8fa2aed125b1768ebd085e83015b074bccd992

CentOS/RHEL 6.6

centos6/osquery-2.3.2-1.el6.x86_64.rpm


sha256: acd3f70d18de7d8ae3163b3f9a445ea9d1146f2c6709c5a59f41db3a185bc790

Install apt repository

We publish osquery in an apt repository for Ubuntu 12.04 (precise), 14.04 (trusty), and 16.04 (xenial):

Ubuntu 16.04 LTS Xenial

$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
$ sudo add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/xenial xenial main"
$ sudo apt-get update
$ sudo apt-get install osquery

Ubuntu 14.04 and 12.04 LTS

$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
$ sudo add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/trusty trusty main"
$ sudo apt-get update
$ sudo apt-get install osquery

Ubuntu DEB

You may also download a pre-built osquery DPKG DEBs that contain the binaries, an init.d script, and example configurations.

Ubuntu 16.04 LTS Xenial

xenial/osquery_2.3.2_1.16.amd64.deb


sha256: 4106002c02106a19918962d6eb32cad03401de25b4eee521be22beff91ff998d

Ubuntu 14.04 & 12.04 LTS

trusty/osquery_2.3.2_1.14.amd64.deb


sha256: c01c78e7a665b85e51142ce5dcace71a780391956999d83c3bb706738726b6f4

 Windows Choco Package

We recommend installing and deploying Windows support using chocolatey. Please let us know if your enterprise could make use of other package formats.

C:\> choco install osquery

For details see the chocolatey project page https://chocolatey.org/packages/osquery.

Windows devkit

Version 2.0.0 is the first with Windows support. As we develop table parity with POSIX, we also recommend following along and contributing to the development effort!

C:\> git clone https://github.com/facebook/osquery
C:\> .\tools\make-win64-dev-env.bat
C:\> .\tools\make-win64-binaries.bat

Links for scripts

Every release version is published to S3 on midnight of the release day. A symlink is created for external projects, package maintainers, and integrations. You can find the latest stable package in each platform and distribution's directory on S3:

https://osquery-packages.s3.amazonaws.com/darwin/osquery.pkg
https://osquery-packages.s3.amazonaws.com/centos7/osquery.rpm
https://osquery-packages.s3.amazonaws.com/centos6/osquery.rpm
https://osquery-packages.s3.amazonaws.com/precise/osquery.deb
https://osquery-packages.s3.amazonaws.com/trusty/osquery.deb
https://osquery-packages.s3.amazonaws.com/xenial/osquery.deb