I have 20 queries in a pack. All of them have same interval of 60 seconds. What I have observed is within 60 seconds all 20 query executed given that data is present in database for all the queries. And if I insert new data for specific query then that query is getting executed in 60 seconds(not exactly 60 seconds)
From this can I conclude that osquery first executes all the queries despite of what is the interval and then actually starts executing queries according to the interval.
It will be very helpful if anyone clarifies this. Thank you
f
FG
06/14/2024, 1:00 PM
the scheduler has a bunch of i guess you could say complexity behind it. there are various things that could effect when queries are actually run like interval, retries, timeouts, blacklisting and things like splay percent etc.