03/28/2022, 9:44 AM
The scheduler itself appears to be in-memory and directly relates to the osqueryd service…. which means if launchd itself wants to mess with it due to system pressure in some way… the whole schedule is lost and counters need to reset again (which would probably only occur after next config check-in)? Also, can I see/predict when a query is supposed to run next, discounting splay?
9:51 AM
another way I could postpone/'skip'/lose the expected execution of a scheduled query (besides launchd being a fancy supervisor): if the computer restarts…