Hacker News new | past | comments | ask | show | jobs | submit login

osquery is cool. But, as far as I know, it doesn't expose the filesystem as a database, it is closer to /proc-as-a-database. (osquery can monitor specific files, in particular security-sensitive files, and expose events related to those files in SQL tables; but I don't think that facility is scalable from certain specific files to the entire filesystem.)



Indeed it isn't, in order to make file-level querying performant at all, you really need support for that at the filesystem level. Which is exactly what BFS, the BeOS filesystem had, and of course Haiku reimplements it: https://www.haiku-os.org/docs/userguide/en/queries.html

As that page describes, the "query" command (or its equivalent GUI) can be used to write filesystem queries, e.g.:

     query ((MAIL:from=="*joe*") && (MAIL:when>=%2 months%))




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: