Does anyone know of a limit of any kind on the

systemd_units

table that would prevent showing everything available that you'd expect to see using

systemctl list-units --all

from the command line?

if you manually set "LIMIT 2000" in your query does the result change? maybe there is a default limit (i don't think so but just to rule it out)

It doesn't. If there's a limit, it might be in the dbus api layer so the data wouldn't ever reach the "sql layer" of osquery.

both the command and osquery run with the same user? Otherwise not sure; it should use the same communication channel so there's something that's not handled/requested.

Yes. Root in all cases.

mmm if it's 1000 precisely might be that there's something that chunks the results and we are not looping.

rats. where's the limit defined?

On our side: https://github.com/osquery/osquery/blob/e4ff72ee0b88e3101ad36cc6328d4634fab7f483/osquery/tables/system/linux/dbus/methods/listunitsmethodhandler.cpp#L16-L17

💥

Should we increase the max or make it configurable?

I mean it depends on how it behaves when increasing that number; it seems reasonable to me to increase it or have something configurable to increase it, but I cannot say which one of the two without knowing the impact.