---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/it-operations-management

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create a check definition

# Create a check definition {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Create a check definition to execute the `osquery` command on the Agent.

## Vorbereitungen

Role required: agent_client_collector_integration or agent_client_collector_admin

## Prozedur

1. In an Event Management instance, navigate to Agent Client CollectorCheck Definitions.
2. Click New.
3. In the Name field, enter <kbd class="ph userinput">util.osquery</kbd>.
4. In the Check type field, enter <kbd class="ph userinput">osquery</kbd>.
5. In the Command field, enter the following script:  

       osqueryi  --logger_min_status 1 --json "{{.labels.params_query}} "

6. In the Plugins field, enter the <kbd class="ph userinput">osquery</kbd> plugin.
7. In the Parameters section, enter the following values for a check parameter definition.

   | Column | Value |
   | Name | query |
   | Default value | select \* from logged_in_users |
   | Mandatory | true |
   |-|-|

   {#acc-api-check-def__choicetable_dhh_xjg_3kb}
8. Click Test check and select one of the available agents.  
   The test result appears, indicating its success or failure.