Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
launchd
launchd
LaunchAgents and LaunchDaemons from default search paths.
| Column | Type | Description |
|---|---|---|
| disabled | text | Skip loading this daemon or agent on boot |
| groupname | text | Run this daemon or agent as this group |
| inetd_compatibility | text | Run this daemon or agent as it was launched from inetd |
| keep_alive | text | Should the process be restarted if killed |
| label | text | Daemon or agent service name |
| name | text | File name of plist (used by launchd) |
| on_demand | text | Deprecated key, replaced by keep_alive |
| path | text | Path to daemon or agent plist |
| process_type | text | Key describes the intended purpose of the job |
| program | text | Path to target program |
| program_arguments | text | Command line arguments passed to program |
| queue_directories | text | Similar to watch_paths but only with non-empty directories |
| root_directory | text | Key used to specify a directory to chroot to before launch |
| run_at_load | text | Should the program run on launch load |
| start_interval | text | Frequency to run in seconds |
| start_on_mount | text | Run daemon or agent every time a filesystem is mounted |
| stderr_path | text | Pipe stderr to a target path |
| stdout_path | text | Pipe stdout to a target path |
| username | text | Run this daemon or agent as this username |
| watch_paths | text | Key that launches daemon or agent if path is modified |
| working_directory | text | Key used to specify a directory to chdir to before launch |
Example
List launch daemons that run an application in the Applications directory.
SELECT * FROM launchd WHERE program LIKE '/Applications/%%' OR program LIKE '/Users/%%/Applications/%%';
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
