hey folks! i wanted to share some metrics i just gathered on osquery auditing performance. I ran 2.11.2, 3.2.6, and a custom build of 3.2.9 with DB optimizations included (see https://github.com/facebook/osquery/pull/4714) The testbeds: - Centos6 (2xCPU cores, 6GB RAM) - Centos7 (2xCPU cores, 6GB RAM) Testing methodology: 1. Install $version of osquery 2. configure flags:

--audit_allow_config=true
--audit_allow_sockets
--audit_persist=true
--disable_audit=false
--events_expiry=1
--events_max=500000
--logger_plugin=filesystem
--watchdog_memory_limit=350
--disable_watchdog=true

3. Run

system_stress.py

3 times on

-n 9

and

-n 10

respectively and average the results Key Takeaways - Audit performance is continuing to improve (thank you @alessandrogario!) - The CPU usage reduction with the new DB optimization is pretty massive! Graphs of time taken and corresponding test CPU usage (collected via datadog) below