osquery – mounts

Reading Time: < 1 minute

osquery> PRAGMA table_info(mounts);
+-----+------------------+--------+---------+------------+----+
| cid | name             | type   | notnull | dflt_value | pk |
+-----+------------------+--------+---------+------------+----+
| 0   | device           | TEXT   | 0       |            | 0  |
| 1   | device_alias     | TEXT   | 0       |            | 0  |
| 2   | path             | TEXT   | 0       |            | 0  |
| 3   | type             | TEXT   | 0       |            | 0  |
| 4   | blocks_size      | BIGINT | 0       |            | 0  |
| 5   | blocks           | BIGINT | 0       |            | 0  |
| 6   | blocks_free      | BIGINT | 0       |            | 0  |
| 7   | blocks_available | BIGINT | 0       |            | 0  |
| 8   | inodes           | BIGINT | 0       |            | 0  |
| 9   | inodes_free      | BIGINT | 0       |            | 0  |
| 10  | flags            | TEXT   | 0       |            | 0  |
+-----+------------------+--------+---------+------------+----+
This entry was posted in Uncategorized. Bookmark the permalink.