High-level deployment overview

This page shows how the osquery charm fits into a typical deployment.

The osquery charm is a subordinate that runs on the same machine as a principal application. On each host, the charm installs and manages the osqueryd daemon. Every agent connects outward over TLS to a centrally managed osquery controller, which supplies the agents’ configuration and collects their logs.

        flowchart TD
    subgraph host1["Machine 1"]
        principal1["Principal application unit"]
        osquery1["osquery subordinate<br/>charm (osqueryd)"]
        principal1 -.->|general-info| osquery1
    end
    subgraph host2["Machine 2"]
        principal2["Principal application unit"]
        osquery2["osquery subordinate<br/>charm (osqueryd)"]
        principal2 -.->|general-info| osquery2
    end
    controller["osquery controller"]
    osquery1 -->|TLS: enroll / config / logs| controller
    osquery2 -->|TLS: enroll / config / logs| controller
    

Key points:

• The general-info relation places one osquery subordinate unit on each principal machine. See Relation endpoints.

• Each osqueryd agent is configured from Juju configurations, which the charm renders into an osquery flagfile. See Configurations.

• All agents communicate with the osquery controller over TLS. The controller, not Juju, owns the fleet’s query schedules, telemetry rules, and log storage.

This charm targets osctrl as the controller. For how to deploy and operate it, see the osctrl documentation.