How do I clear performance stats (user_time, average_memory, etc.) from

osquery_schedule

? I modified the

query

in my schedule (but the name remained the same), yet osquery is still reporting the old stats from the previous query. Is this intended? I expected the stats to reset if the actual query is now different. Relevant config:

"packs": {
        "Global": {
            "queries": {
                "Get JetBrains Plugins": {
                    "query": "select * from time;",
                    "interval": 3600,
                    "platform": "",
                    "version": "",
                    "snapshot": true
                }
            }
        },

Unfortunately it only keeps track of the name: https://github.com/osquery/osquery/blob/master/osquery/config/config.cpp#L1021; since they are not persisted across restarts, that for now would be the only way

Would you be open to clearing the peformance stats if query was modified? I can open the issue and make the fix.

technically, I don't have issues. I guess you can do that in the config update function and then comparing the query strings? Not sure if there is some hidden reason that an end user would care about though. Also distributed queries might have the same issue.

I opened https://github.com/osquery/osquery/issues/8209

No there's no persistent storage, the issue is still valid

Are we open to adding persistent storage, like a sqlite DB?

there's already RocksDB for that, where we buffer logs and so on

Ok, I'll update the issue.