---
title: Install osquery (Canonical build) on Linux | Snap Store
description: Get the latest version of osquery (Canonical build) for Linux - SQL powered
  operating system instrumentation and analytics
url: https://snapcraft.io/c-osquery
---

# osquery (Canonical build) (c-osquery)

[Canonical SecOps (secops-service-account)](https://snapcraft.io/publisher/secops-service-account "View all snaps from Canonical SecOps (secops-service-account)")

* [Canonical SecOps (secops-service-account)](https://snapcraft.io/publisher/secops-service-account "View all snaps from Canonical SecOps (secops-service-account)")

latest/edge 5.21.0

Install latest/edge of osquery (Canonical build)

---

**Install using the command line**

```
sudo snap install c-osquery --edge --classic
```

Don't have snapd? [Get set up for snaps](https://snapcraft.io/docs/installing-snapd).

osquery (Canonical build) is only available on the unstable edge channel. It could break and change often.

---

### Package name

* c-osquery

---

### License

* (Apache-2.0 OR GPL-2.0-only)

---

### Last updated

* 5 October 2026 - latest/edge

---

##### Report a Snap Store violation

* [Report this Snap](https://snapcraft.io/c-osquery#report-snap-modal)

---

* [Description](https://snapcraft.io/c-osquery#tab-description)
* [Security](https://snapcraft.io/c-osquery#tab-security)

#### SQL powered operating system instrumentation and analytics

osquery exposes an operating system as a high-performance relational
database, enabling SQL-based queries over processes, files, network
connections, and other host state. Built on core22/LLVM-14 with BPF
support, packaged so it can run on any snapd-enabled host with a
compatible kernel, independent of the host distro's own userspace
library versions.

Confinement note: osquery's BPF backend needs perf\_event/tracefs access
and effectively CAP\_SYS\_ADMIN/CAP\_BPF-level privilege to trace syscalls
system-wide -- there is no strict-confinement interface that covers this,
so this snap requests classic confinement, the same effective privilege
the .deb already has.

---

## Install osquery (Canonical build) on your Linux distribution

Choose your Linux distribution to get detailed installation instructions. If yours is not shown, get more details on the [installing snapd documentation](https://snapcraft.io/docs/installing-snapd).

[### Arch Linux](https://snapcraft.io/install/c-osquery/arch)

[### CentOS](https://snapcraft.io/install/c-osquery/centos)

[### Debian](https://snapcraft.io/install/c-osquery/debian)

[### elementary OS](https://snapcraft.io/install/c-osquery/elementary)

[### Fedora](https://snapcraft.io/install/c-osquery/fedora)

[### KDE Neon](https://snapcraft.io/install/c-osquery/kde-neon)

[### Kubuntu](https://snapcraft.io/install/c-osquery/kubuntu)

[### Manjaro](https://snapcraft.io/install/c-osquery/manjaro)

[### Pop!\_OS](https://snapcraft.io/install/c-osquery/pop)

[### openSUSE](https://snapcraft.io/install/c-osquery/opensuse)

[### Red Hat Enterprise Linux](https://snapcraft.io/install/c-osquery/rhel)

[### Ubuntu](https://snapcraft.io/install/c-osquery/ubuntu)