I have gigs of data stored inside osquery.db. Ther...
# general
j
I have gigs of data stored inside osquery.db. There’s SST files older than 30 days. I’m not using any of the
_event
tables. My understanding is that query results expire. I’m on Linux using osquery v3.3.2. Is there a way to trigger a DB clean-up?
Copy code
➜  rocksdb_sst_dump --file=/[…]/064081.sst --command=scan --read_num=1
from [] to []
Process /[…]/064081.sst
Sst file format: block-based
'tls_r_1575709087_29612' seq:0, type:1 => {"name":"pack_process_open_sockets","hostIdentifier":"[…]","calendarTime":"Sat Dec  7 08:58:05 2019 UTC","unixTime":1575709085, […]},"action":"added"}
👀 1