I have been checking event control flags and I have two doubts about the behavior of the event buffering.
- I’ve seen that --events_expiry flag sets the time an event is going to be stored (i suppose in rocksDB) after being consulted until being deleted, but that means that if I never do a select on the correspondient table, is never going to be removed? (until events-max value is reached)
- In the case I loose (for any reason) the connection with fleet, osquery is still working and pub-sub is storing events in rocksDB but when the connection is restablised how stored events and new events are sent? First the old ones and then the new ones? it does some kind of round robin?
I suppose that is the first one since events works with event timestamp as offset but I’d like to know a bit deeper how it works.
Maybe these are quite newbie/stupid questions, but I would like to know the behavior in both cases.