Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

corestorage_logical_volumes

Information about CoreStorage Logical Volumes from the diskutil coreStorage list -plist command.

Column	Type	Description
ContentHint	text	What type of filesystem is on the logical volume, as written in metadata, e.g. "Apple_HFS"
ConversionState	text	Status of the conversion, e.g. from HFS+ to CoreStorage or encrypting a volume
ConverstionProgressPercent	integer	How far the current conversion status has progressed, either empty or 0-100
DesignatedPhysicalVolume	text	UUID of one of the physical volumes on which the logical volume is stored
DesignatedPhysicalVolumeIdentifier	text	Identifier of one of the physical volumes that holds this logical volume (e.g disk0s2)
Identifier	text	Current identifier of the logical volume (e.g. "disk5")
Name	text	Name of the logical volume
Sequence	bigint	Sequence number of the logical volume
Size	bigint	Size of the logical volume in bytes
Status	text	Lock status of the logical volume, e.g. "Locked"
UUID	text	Unique ID of the logical volume
Version	bigint	CoreStorage version of the logical volume, normally 65536
VolumeName	text	Name of the filesystem in the logical volume
lvf_EncryptionStatus	text	Unlock status of the logical volume family, e.g. "Locked" or "Unlocked"
lvf_EncryptionType	text	Encryption algorithm for the logical volume family, normally "AES-XTS" or "None"
lvf_HasVisibleUsers	integer	Undocumented field returned from `diskutil cs info`
lvf_HasVolumeKey	integer	Whether there is an encryption key assigned for the logical volume
lvf_IsAcceptingNewUsers	integer	Whether new users may be granted access to the logical volume family encryption key
lvf_IsFullySecure	integer	Undocumented field returned from `diskutil cs info`
lvf_MayHaveEncryptedEvents	integer	Undocumented field returned from `diskutil cs info`
lvf_RequiresPasswordUnlock	integer	Whether a password is currently required to unlock the volume
lvf_UUID	text	Unique ID of the logical volume family
vg_FreeSpace	bigint	Amount of space, in bytes, in the volume group that have not been allocated by any logical volume
vg_FusionDrive	integer	Whether the volume group is a "fusion drive" (i.e. SSHD)
vg_Name	text	The customizable name of the volume group
vg_Sequence	bigint	Current sequence number of the volume group
vg_Size	bigint	Total (i.e. either allocated or unallocated) size of the volume group
vg_Sparse	integer	Whether the volume group allows overcommitting storage
vg_Status	text	Status of the volume group, e.g. "Online"
vg_UUID	text	The unique identifier of the containing volume group
vg_Version	integer	The version of the volume group, probably 1