Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
corestorage_logical_volume_families
Information about CoreStorage Logical Volume Families from the diskutil coreStorage list -plist
command.
Column | Type | Description |
---|---|---|
EncryptionStatus | text | Unlock status of the logical volume family, e.g. "Locked" or "Unlocked" |
EncryptionType | text | Encryption algorithm for the logical volume family, normally "AES-XTS" or "None" |
HasVisibleUsers | integer | Undocumented field returned from diskutil cs info |
HasVolumeKey | integer | Whether there is an encryption key assigned for the logical volume |
IsAcceptingNewUsers | integer | Whether new users may be granted access to the logical volume family encryption key |
IsFullySecure | integer | Undocumented field returned from diskutil cs info |
MayHaveEncryptedEvents | integer | Undocumented field returned from diskutil cs info |
RequiresPasswordUnlock | integer | Whether a password is currently required to unlock the volume |
UUID | text | Unique ID of the logical volume family |
vg_FreeSpace | bigint | Amount of space, in bytes, in the volume group that have not been allocated by any logical volume |
vg_FusionDrive | integer | Whether the volume group is a "fusion drive" (i.e. SSHD) |
vg_Name | text | The customizable name of the volume group |
vg_Sequence | bigint | Current sequence number of the volume group |
vg_Size | bigint | Total (i.e. either allocated or unallocated) size of the volume group |
vg_Sparse | integer | Whether the volume group allows overcommitting storage |
vg_Status | text | Status of the volume group, e.g. "Online" |
vg_UUID | text | The unique identifier of the containing volume group |
vg_Version | integer | The version of the volume group, probably 1 |
This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).