Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use osqueryd as a lightweight evidence collector on your Linux VPS: schedule SQL checks for users, packages, services, processes and sockets; enable event tables when you need activity in near real time; turn on file-integrity monitoring (FIM) for SSH keys and selected /etc paths; then send the results to a protected local or TLS collector. This gives you change detection and searchable telemetry, not automatic intrusion prevention.
The reliable deployment order is to install the package, validate queries with osqueryi, start a small osqueryd schedule, configure FIM, add process or socket auditing only where justified, and verify logging with a controlled test. Keep the monitored scope and event volume small until CPU use, queueing, retention and alerting are proven.
What osquery monitors on a VPS
osquery exposes operating-system information as SQL tables. The interactive osqueryi shell is for exploring those tables and testing statements. The long-running osqueryd daemon runs the statements on a schedule, compares ordinary query results with the previous run, and writes change records or snapshots to a logger.
That distinction matters when you design alerts:
| Telemetry type | What is recorded | Typical security use |
|---|---|---|
| Scheduled query against an ordinary table | Rows that are added or removed since the previous result, unless you configure a snapshot |
Detect a new account, package, service, process or listening socket |
| Snapshot query | The complete result at every interval | Periodic inventory when a full state record is more useful than a diff |
| Event table | Time-series activity generated by an event source | File changes, process execution or socket activity between scheduled runs |
Scheduled intervals are approximate. A five-minute interval is a target, not a timestamp guarantee, and a busy host or logger can delay delivery. Event tables provide activity records but can generate substantially more data than state-diff queries.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Define a useful security baseline
Write down the questions you need to answer before enabling every available table. A practical first baseline asks:
- Which users, groups, login shells and SSH-related accounts exist?
- Which packages and services are installed, and which of them change?
- Which processes are running and which sockets are listening?
- Did an SSH key, system configuration file or monitored directory change?
This keeps the first deployment actionable. osquery is a scheduled-query and state-change monitor; it does not block a login, kill a process, quarantine malware or replace a firewall, patch process or incident-response plan.
Recommended Free Tools
Install and start osquery on the VPS
Install the package
Use the package supplied for your Linux distribution, adding the osquery package repository when the distribution does not provide a current package. On Debian-family systems the package command is commonly:
sudo apt-get update
sudo apt-get install osqueryOn a Red Hat-family system, the equivalent package-manager command is commonly:
sudo dnf install osqueryRepository names and package availability vary by distribution and release. Confirm that the installed package provides both osqueryi and osqueryd before continuing.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Check the binaries and service
- Run
osqueryi --versionand record the installed version in your change log. - Open the SQL shell with
sudo osqueryi. Use.tablesto list available tables and.schema users(or another table name) to inspect columns. - Locate the daemon configuration and log directories used by your package. Distribution packages normally provide a systemd unit named
osqueryd. - After placing a valid configuration, run
sudo systemctl enable --now osqueryd, then inspectsudo systemctl status osquerydand the daemon’s status log.
Do not enable a large event configuration before proving that the daemon can start with a minimal schedule. A syntax error or an unsupported option can prevent all monitoring.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteExplore tables interactively before scheduling them
Use osqueryi to see what your VPS actually exposes. These examples are deliberately small:
SELECT username, uid, gid, shell, directory FROM users;
SELECT groupname, gid, members FROM groups;
SELECT name, version, source FROM deb_packages;
SELECT name, path, pid, uid FROM processes;
SELECT address, port, protocol, pid, process_path FROM listening_ports;
SELECT name, status, pid, path FROM services;Package-table names differ by operating system. For example, a Debian host may expose deb_packages, while a Red Hat-family host may expose rpm_packages. Query the table list and schema rather than copying a package query that does not exist on your host.
Inspect event-table schemas before enabling them. If an event table is unavailable, the corresponding event source or platform support is not active; scheduling the query alone will not create events.
Build a small scheduled-query configuration
Choose intervals by decision speed
Use a short interval only when you can investigate the resulting changes quickly. A five-minute account or package check is often easier to operate than a one-minute check that creates duplicate noise. Keep inventory queries slower when a change does not require immediate action. Query packs can group related checks; the official configuration model includes broad compliance and vulnerability-management packs, but a VPS owner should begin with a custom pack that remains readable.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Example schedule
The following illustrates the shape of a configuration. Adjust table names and columns after checking your host’s schema:
{
"schedule": {
"users_and_groups": {
"query": "SELECT username, uid, gid, shell, directory FROM users; SELECT groupname, gid, members FROM groups;",
"interval": 300
},
"packages": {
"query": "SELECT name, version, source FROM deb_packages;",
"interval": 900
},
"services": {
"query": "SELECT name, status, pid, path FROM services;",
"interval": 300
},
"listening_sockets": {
"query": "SELECT address, port, protocol, pid, process_path FROM listening_ports;",
"interval": 120
}
}
}Many osquery deployments use one statement per scheduled item. If your package rejects multiple statements in one item, split the users and groups checks into separate schedule entries. After saving the configuration, restart or reload the daemon according to your package’s service behavior and verify the first result batch in the filesystem logger.
Understand the resulting records
For an ordinary scheduled table, osquery compares the current rows with the prior result and emits rows marked added or removed when state changes. A newly created account therefore produces an addition, while deleting an account produces a removal. A snapshot query emits the complete table each interval, which is useful for reconstruction but increases storage and processing. Do not alert on every row of a snapshot as though it were a new event.
Enable file-integrity monitoring for SSH and /etc
How Linux FIM works
Linux FIM uses the file_events table and inotify. It is disabled by default: you must enable event support, enable the relevant table in the osquery configuration, and define paths in file_paths or dynamically with file_paths_query. Events are captured as they happen and flushed to the logger on the scheduled query interval.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Start with high-value paths
Monitor the root account’s authorized keys, each user’s SSH directory and selected system configuration files. The documented path-pattern style is:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
"file_paths": {
"ssh_keys": [
"/root/.ssh/authorized_keys",
"/root/.ssh/%%",
"/home/%/.ssh/%%"
],
"system_configuration": [
"/etc/%%"
]
}%% matches recursively in the osquery path-pattern syntax. Watching all of /etc can be noisy on a busy VPS, so narrow the list to authentication, privilege, service and network configuration files when you know which ones matter. Use exclusions for directories that are expected to churn.
Schedule the event table
Add a query such as:
SELECT * FROM file_events;Use the event record’s path, action, timestamp and process information (where available) to decide whether a change is expected. A package upgrade may legitimately replace a configuration file; an unexpected write to an authorized-keys file deserves immediate investigation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Test replacement and inotify capacity
Some applications replace a file atomically instead of editing it in place. Monitoring only the original file can miss the replacement; monitoring the containing directory preserves visibility when the inode changes. Make a controlled, reversible change to a test file under a monitored path, wait for the scheduled flush, and confirm that the event reaches your logger before relying on the rule.
Linux limits the number of watches and event buffers. The controls documented for this workload are fs.inotify.max_user_watches, fs.inotify.max_user_instances and fs.inotify.max_queued_events. Raising them consumes additional non-swappable kernel memory. Increase them only after measuring watch counts and queue behavior, and record the change so it can be reproduced after a reboot.
Add process and socket visibility selectively
Process execution events
For near-real-time execution telemetry, enable the Linux Audit-backed event source and schedule:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
SELECT * FROM process_events;Use this when you need to know that a command ran, not merely which processes existed at the last inventory interval. Correlate the executable, user, parent process, command line and timestamp with your deployment and authentication logs.
Socket events
For network activity, enable the corresponding event source and schedule:
SELECT * FROM socket_events;This can reveal unexpected outbound connections or listeners that a periodic socket inventory might miss. Start with a narrow retention window and a collector that can search by address, port, process and time.
Control the cost
Process and socket auditing can add CPU overhead and greatly increase event volume. Official guidance warns that performance impact depends on host activity and should be tested in the target environment. Enable one source at a time, measure CPU and memory, watch queueing and dropped records, and expand only when your logger and retention system can keep up.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose local or centralized logging
Filesystem logging for one VPS
The filesystem logger is the simplest starting point. Keep its directory writable only by the osquery service account and administrators, monitor free space, rotate files, and forward them to your existing log system if you need off-host retention. Local logs alone are vulnerable to loss if an attacker gains root access and deletes or alters them.
TLS collection for a fleet or durable audit trail
osquery’s TLS remote plugin retrieves JSON configuration and accepts POSTed result or status payloads. Result data and status data are separate log types in the TLS protocol. A collector should authenticate each node, validate payloads, protect private keys, apply retention, and expose alerts and search to responders.
A secure central design has these controls:
- Use HTTPS/TLS with certificate validation and a unique node identity.
- Restrict who can change remote configuration; a malicious schedule can hide activity or create an event flood.
- Store result and status streams separately so delivery failures are visible rather than mixed with security events.
- Monitor failed posts, queue growth, clock skew and collector rejection responses.
- Define retention and alert ownership before enabling high-volume event tables.
Remote HTTP/TLS configuration also lets you change schedules centrally, but it increases the importance of protecting the configuration endpoint and its signing or authentication keys.
Quick Recap
Verify the deployment with a controlled test
- Run each baseline query in
osqueryiand save the expected columns and a known-good result. - Start
osquerydwith only the baseline schedule. Confirm that the first result batch appears locally or at the collector. - Enable FIM for one SSH path and one harmless test file under a monitored configuration directory.
- Make a documented, reversible change, such as adding and removing a test line, and confirm the expected
file_eventsrecord. - Enable process or socket auditing only if the security question requires event-level data. Generate one controlled test event and verify timestamps, identity and delivery.
- Measure CPU, memory, event rate, queue depth, disk use and collector retention for at least one normal operating cycle before expanding coverage.
- Document the final paths, schedules, exclusions, alert thresholds, ownership and rollback steps in your VPS runbook.
Troubleshoot common failures
| Symptom | Likely cause | Action |
|---|---|---|
| The daemon will not start | Invalid JSON, unsupported option or an unavailable table | Validate the configuration, remove the newest block, run the query in osqueryi, then inspect the service status log. |
| No file events appear | FIM or the file-event table is not enabled, or no path pattern matches | Check event options, path syntax and permissions; test with a controlled change and wait for the scheduled flush. |
| Events stop after a file is replaced | Only the old inode was watched | Monitor the containing directory as well as the individual file, then retest an atomic replacement. |
| Events are delayed | They are buffered until the scheduled query interval, or the logger is backlogged | Check the interval, queue depth, disk space, CPU load and collector response time. |
| CPU or log volume jumps | Broad /etc coverage, process auditing or socket auditing is too noisy |
Narrow paths, add exclusions, lengthen intervals, disable unneeded event sources and verify retention before re-enabling. |
| Central collection fails | TLS identity, certificate, endpoint or permissions problem | Check status logs separately from result logs, validate certificates and keys, confirm node authentication and inspect collector rejection messages. |
| Inotify queues overflow | Too many watched paths or bursts of filesystem activity | Reduce scope first; only then evaluate the documented inotify limits and the memory cost of raising them. |
Choose a design that fits your VPS count
| Design | Coverage | Overhead and volume | Collection | Best fit |
|---|---|---|---|---|
| Scheduled state checks with local logs | Periodic users, packages, services, processes and sockets | Lowest operational complexity; volume follows query frequency | Filesystem logger on the host | One VPS and an initial baseline |
| Scheduled checks plus FIM | Baseline state plus changes under selected SSH and system paths | Inotify watch and event volume depend on path scope | Local files or forwarded results | Protecting authorized keys and configuration |
| FIM plus process and socket events | File, execution and network activity streams | Highest CPU and log-volume risk; requires testing | Prefer a searchable, durable collector | Hosts where event-level investigation is justified |
| TLS-managed fleet | Central schedules, results and status across many nodes | Collector capacity, authentication and retention become primary concerns | Remote HTTPS/TLS service | Multiple VPSs or a durable audit requirement |
Operational limits to keep in mind
- osquery reports what its tables and event sources observe; it does not prove that an undetected change did not occur.
- Scheduled diffs, snapshots and event streams have different meanings. Build alerts for the record type you actually receive.
- FIM coverage is explicit. A path outside your patterns is not monitored, and an overly broad pattern can make useful alerts disappear in noise.
- Audit-backed process and socket monitoring can affect performance. Test on the real workload rather than assuming a fixed cost.
- A local logger is not an immutable audit trail. Centralize over TLS when you need off-host retention, fleet-wide configuration or independent alerting.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
