fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
3.17k stars 435 forks source link

Support smart.go library to access disk S.M.A.R.T information #17378

Open dherder opened 9 months ago

dherder commented 9 months ago

Problem

With the deprecation of SMART disk table (https://github.com/osquery/osquery/issues/7464) (smart_drive_info) in osquery, IT users do not have a way to report on useful disk S.M.A.R.T status information. This was deprecated in Fleet as of https://github.com/fleetdm/fleet/issues/7876

Fleet could leverage https://github.com/anatol/smart.go to access this information.

noahtalerman commented 9 months ago

Thanks for tracking this @dherder.

@zwass, looking at this osquery issue, it sounds like this table was hard to maintain?

Assuming we found a different solution (not sure what), what do you think the level of effort would be?

zwass commented 9 months ago

Exposing the information in that library via an extension table in fleetd would be a pretty small amount of effort. That's assuming it works and not counting the testing across various OSes and devices to check if it does actually work as expected (which I suspect would be more work than building the table itself).

Contributing to core osquery looks harder. If the smart.go library code works well, some of the C++ could be borrowed to use in osquery as that would be allowed by the MIT license.

noahtalerman commented 9 months ago

@willmayhone88 what information are they looking for? Is there an existing table that could get this info?

noahtalerman commented 8 months ago

cc @dherder ^^

dherder commented 8 months ago

Hey @noahtalerman we originally thought that SMART status wasn't a thing on SSDs anymore, and would only apply to spinning drives. Turns out that is not the case and SMART status has application for ssds as well. This feature is to provide an alternative table for SMART status to replace the deprecated osquery table.