Use osqueryd as a small, query-driven sensor on the VPS: schedule baseline SQL queries, enable file events for SSH and critical /etc paths, add Audit-backed process or socket events only when needed, and send the resulting logs to a protected collector. Start locally so you can prove the data is useful, then move configuration and retention to TLS when you operate more than one host or need a durable audit trail.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What osquery monitors—and what it does not
osquery exposes operating-system information as SQL tables. The long-running osqueryd daemon schedules queries, compares results, and records state changes. The osqueryi shell is an interactive console for exploring tables and testing SQL before you put a query into the daemon configuration.
As an Amazon Associate I earn from qualifying purchases.
This makes osquery a host-monitoring and evidence-collection layer, not an intrusion-prevention system. It can show that a key file changed, a process executed, or a socket appeared; it does not automatically decide whether an administrator’s change was malicious, block the process, or repair the host. Your collector and alerting rules must provide that response workflow.
The four pieces of a useful deployment
- Install the Linux package. The package supplies
osqueryi,osqueryd, tables, and eventing support. - Configure and start the daemon. Give it a schedule, logging destination, and any event options.
- Define scheduled queries and packs. Keep the first set small and tied to questions you can act on.
- Collect and review the output. A local filesystem logger is adequate for one VPS; a TLS collector provides centralized configuration, retention, and alerting for a fleet.
Understand the three result behaviors
| Query or table type | What is emitted | Best use |
|---|---|---|
| Ordinary scheduled table | osquery compares the current result with the previous result and emits rows marked added or removed when state changes. |
Users, groups, installed software, services, processes, and listening sockets where a changed inventory matters. |
| Event table | A time-series stream of events as they occur; the daemon flushes collected events to the logger on the scheduled interval. | File changes, process execution, or socket activity that must be tied to a time and actor. |
| Snapshot query | The complete result set is returned at every interval. | Periodic inventories when a full point-in-time record is more useful than a change-only stream. |
These behaviors are not interchangeable. A five-minute inventory can tell you that a listener exists, while socket_events can show activity between inventory runs. Event-level visibility costs more in CPU, storage, and search volume, so enable it for a defined detection question rather than by default.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose security questions before writing SQL
A focused VPS baseline should answer four questions:
- Which users, groups, shells, and SSH-related accounts exist?
- Which packages and services are installed, and when does that inventory change?
- Which processes and listening sockets are present?
- Did a protected file or directory change?
Write down the response for each question. For example, a new authorized key may require disabling an account and rotating credentials; a new listening socket may require identifying the owning process and reviewing the deployment; a package change may be expected during maintenance. If no one will investigate a result, do not collect it yet.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Install and verify osquery on the VPS
Use the package instructions for the Linux distribution and osquery release you have approved. Repository setup and package names differ between distributions, so do not copy a repository command intended for another release. After installation, verify both binaries and the service unit.
- Install the distribution-appropriate osquery package with your normal privileged package workflow.
- Check the installed version with
osqueryi --version. - Open the interactive console with
sudo osqueryiand run a harmless query such asSELECT username, uid, gid, shell, directory FROM users;. - Locate the package’s configuration and log directories. Common packages use
/etc/osquery/osquery.confand a directory under/var/log/osquery, but confirm the paths on your image. - Keep the daemon stopped while you validate the initial JSON, then enable and start the service using the service manager supplied by your distribution.
Run an interactive query first. It catches table-name and column mistakes without waiting for a schedule, and it lets you see whether a table is populated on this particular VPS.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Create a small scheduled-query baseline
Begin with ordinary tables and a deliberately modest interval. The interval is approximate: osquery schedules work around the requested period rather than promising a precise execution timestamp.
Useful baseline queries
| Security question | Example SQL | Interpretation |
|---|---|---|
| Local accounts and login shells | SELECT username, uid, gid, shell, directory FROM users; |
Watch for unexpected privileged users, changed shells, or accounts that should be locked. |
| Group membership | SELECT * FROM user_groups; |
Investigate additions to administrative groups. |
| Running processes | SELECT pid, name, path, cmdline, uid FROM processes; |
Detect new or replaced executables in a state inventory. |
| Listening sockets | SELECT * FROM listening_ports; |
Compare exposed ports with the VPS firewall and intended services. |
| Services | SELECT * FROM services; |
Identify newly installed or modified service definitions where the table is supported. |
Package inventory tables are platform-specific. Use the table that matches the operating system package manager (for example, a Debian-family package table on Debian-family systems or an RPM-family table on RPM-based systems), test it in osqueryi, and schedule only the query that works on your image.
Recommended Free Tools
Keep the configuration readable
A minimal configuration normally contains an options object, a schedule object, and optional query packs and event sections. The following illustrates the shape; adjust table names, intervals, logger paths, and options to your installed version.
{
"options": {
"logger_plugin": "filesystem",
"logger_path": "/var/log/osquery"
},
"schedule": {
"accounts": {
"query": "SELECT username, uid, gid, shell, directory FROM users;",
"interval": 300
},
"groups": {
"query": "SELECT * FROM user_groups;",
"interval": 300
},
"process_inventory": {
"query": "SELECT pid, name, path, cmdline, uid FROM processes;",
"interval": 300
},
"listeners": {
"query": "SELECT * FROM listening_ports;",
"interval": 300
}
}
}Validate the JSON before restarting the daemon. A syntax error, an unavailable table, or an invalid option can prevent the service from starting. After the first interval, inspect the filesystem logger and confirm that the expected result batch contains query names, timestamps, and rows.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Use packs without losing control
Query packs group related checks such as compliance or vulnerability-management queries. They are useful when several hosts share a policy, but a VPS operator should keep a custom pack small and readable. Put a query in a pack only when you know its interval, expected row count, and response owner. Review inherited packs for noisy or irrelevant checks before enabling them.
Watch SSH keys and critical configuration with file events
Linux file-integrity monitoring (FIM) uses the file_events table and inotify. It is disabled by default. You must enable event support, enable the file-event table for your package, and define paths in file_paths or dynamically with file_paths_query.
Start with high-value paths
A practical first scope is the root account’s SSH directory, every users’ SSH directory, and selected system configuration. The documented path patterns use recursive wildcards:
"file_paths": {
"ssh": [
"/root/.ssh/%%",
"/home/%/.ssh/%%"
],
"system_configuration": [
"/etc/%%"
]
}Monitoring all of /etc gives broad coverage but can be noisy on a busy host. Narrow it to files that control access and services—such as SSH daemon configuration, privilege policy, service definitions, and scheduled-task configuration—then expand after measuring event volume. Use exclusions for known high-churn directories rather than silently ignoring the entire parent tree.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Account for replacement-style writes
Many applications write a new temporary file and rename it over the old file instead of editing in place. If you monitor only the original file, that replacement can reduce visibility. Watching the containing directory, as the recursive patterns do, helps capture create, delete, and rename activity around the protected file.
Test FIM safely
- Confirm that the daemon is running and that file events are enabled.
- Create a clearly named temporary file inside one monitored test directory; do not alter a live authorized-key or policy file just to generate telemetry.
- Modify and then remove that test file during a maintenance window.
- Wait for the scheduled event flush and verify the create, modification, rename, or delete record in the local logger.
- Record the test, path, timestamp, and expected event in your operations runbook.
Events are recorded as they happen but are normally flushed to the logger on the scheduled query interval. A quiet log immediately after a change may therefore mean the flush interval has not elapsed, not that FIM failed.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check inotify capacity before expanding coverage
Each watched path consumes kernel resources. Linux exposes three controls that matter for a busy VPS: fs.inotify.max_user_watches, fs.inotify.max_user_instances, and fs.inotify.max_queued_events. Inspect their current values and watch for queue-overflow or watch-allocation errors in the osquery log and kernel log. Raising them consumes additional non-swappable kernel memory, so size them for the paths and event rate you actually need, then monitor memory after the change.
Add process and socket event telemetry selectively
For near-real-time execution records, schedule:
SELECT * FROM process_events;For network activity, use the corresponding socket_events table. These event tables rely on the Linux Audit-backed event source. Enable that source according to the options supported by your installed package, verify that the Audit subsystem is available, and begin with a narrow scope.
Process and socket auditing can generate substantially more rows than a five-minute inventory. The official osquery guidance warns that enabling these features may affect performance depending on host activity and should be tested in the target environment. Measure CPU use, memory, event rate, queueing, and collector retention before expanding coverage. If your collector cannot retain and search the stream, reducing scope is safer than accepting silent loss.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchLog locally first, then centralize over TLS
Filesystem logging for one VPS
The filesystem logger is the simplest starting point. Restrict the log directory to administrators, include it in your backup or retention policy, and monitor free space. A local log proves that queries and events work before network delivery introduces another failure point.
What the TLS remote plugin does
The TLS remote plugin retrieves JSON configuration from a central service and accepts HTTPS POSTs containing osquery result or status payloads. Result data and status data are separate log types in the TLS protocol. Your central service must authenticate each node, validate payloads, protect client and server keys, and store the events where retention and alerts are defined.
Central-collection rollout
- Deploy an HTTPS endpoint that implements the osquery TLS configuration and logging protocol.
- Issue a distinct node identity and credentials for each VPS; do not share a private key across hosts.
- Configure the daemon’s TLS logger and remote-configuration settings using the option names supported by your osquery version. Keep the local logger enabled during the migration if disk capacity permits.
- Start with one host and confirm that it can fetch configuration, post result payloads, and post status payloads.
- Verify certificate validation, clock correctness, authentication failures, and retry behavior at the collector.
- Only after delivery is proven, enroll additional hosts and define retention, indexing, and alert rules.
Treat the collector as part of the security boundary. Use HTTPS/TLS, restrict who can change remote configuration, protect credentials, alert on delivery failures, and separate ingestion permissions from administrative permissions. A compromised configuration service can change what every daemon collects, so configuration changes need their own audit trail.
Turn osquery records into useful alerts
Raw rows are evidence; an alert needs context and an owner. Normalize the hostname, query name, event action, path, process identity, user ID, and timestamp at ingestion. Preserve the original payload so an investigator can reproduce the decision.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
High-value detections for a VPS
- SSH changes: a new or removed file below an SSH directory, especially an authorized-key file, outside a maintenance window.
- Privilege changes: a new account, shell change, or addition to an administrative group.
- Configuration changes: modifications below selected
/etcpaths that are not linked to a recorded deployment. - Exposure changes: a new listening socket or service that is absent from the approved inventory.
- Execution changes: a process event whose path, user, parent, or command line is inconsistent with the service’s normal behavior.
- Sensor health: missing status reports, TLS authentication failures, event-queue errors, or a sudden drop to zero results.
Correlate these records with your deployment calendar and access logs. A package upgrade may legitimately replace several files; an unplanned key change followed by a new listener deserves a higher-priority investigation than either event alone.
Operating procedure for a reliable rollout
- Explore first: use
osqueryito test every table and column on the target image. - Schedule a baseline: add accounts, groups, process inventory, listeners, and the package table appropriate to the distribution.
- Confirm the first batch: check the logger for successful query results before enabling event sources.
- Enable FIM: turn on Linux file events and monitor SSH directories plus selected
/etcpaths. - Run a controlled test: create and remove a test file, then verify the expected event and flush timing.
- Add Audit-backed events only for a defined need: start with process or socket events, not both everywhere, and measure overhead.
- Tune operations: review CPU, memory, inotify capacity, event volume, queueing, disk use, search performance, and retention.
- Centralize when justified: move configuration and logs to a TLS collector when a second host, durable audit trail, or shared alerting workflow makes local-only storage insufficient.
Design choices: one VPS versus a fleet
| Design | Coverage | Overhead and volume | Collection and operations | When it fits |
|---|---|---|---|---|
| Scheduled state queries with local files | Periodic inventories and added/removed rows. | Lowest complexity; volume follows query size and interval. | Manual review and host-local retention; delivery failures are limited to the host. | One VPS, initial validation, or a low-change server. |
| FIM plus scheduled state | Directory and file changes in addition to inventories. | Inotify watches and event bursts require capacity and exclusion tuning. | Local evidence is useful, but disk retention and access controls are your responsibility. | SSH and system-configuration protection on a production VPS. |
| Audit-backed process and socket events | Event-level execution and network activity. | Potentially high CPU and log volume; test before broad deployment. | Requires a collector that can ingest, retain, and search streams without dropping data. | Incident detection or investigations that inventories cannot answer. |
| TLS centralization | Any of the above, aggregated across hosts. | Network and collector capacity become part of the design. | Central configuration, authentication, retention, alerting, and delivery-health monitoring. | More than one VPS or a required durable audit trail. |
Troubleshoot the common failure modes
The daemon will not start
- Validate JSON syntax and check the service manager’s status and journal output.
- Remove the last option or schedule you added and restart to isolate the invalid setting.
- Run each SQL statement in
osqueryi; a table available on one distribution may not exist on another. - Confirm that the service account can read the configuration and write to the logger directory.
Scheduled results appear, but FIM is empty
- Confirm that event support and file events are enabled, not merely that
file_pathsis present. - Check that the monitored path exists and that the daemon can access it.
- Make a controlled change, wait for the event flush interval, and inspect both osquery status output and the logger.
- Look for inotify watch-allocation or queue errors; reduce noisy paths or adjust kernel limits deliberately.
Events are too numerous
- Narrow recursive paths and add exclusions for known churn.
- Increase scheduled intervals for inventories that do not need frequent comparison.
- Enable process or socket auditing only for hosts and questions that justify it.
- Check collector ingestion, indexing, and retention before collecting more.
TLS delivery fails
- Verify DNS, routing, certificate trust, hostname validation, and system time.
- Confirm node authentication and that the endpoint accepts configuration, result, and status requests.
- Inspect osquery status logs for retry or authentication errors and collector logs for rejected payloads.
- Keep a local logger during diagnosis so a network outage does not erase the evidence you are trying to deliver.
What a secure minimum looks like
For a single Linux VPS, the minimum defensible deployment is a tested osqueryd service with scheduled account, process, listener, and distribution-appropriate package queries; filesystem logging with protected permissions; FIM covering SSH directories and selected access-control configuration; and a documented test proving that a change reaches the logger. Add Audit-backed process or socket events only when their investigative value outweighs their measured overhead. Once you operate multiple hosts or need tamper-resistant, durable review, use authenticated TLS collection and monitor the health of both the sensors and the collector.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
