Hello everyone ! 🙂
I have an interesting use case, and did a little bit of research on RocksDB and previous ideas that popped around in the Github issues (
https://github.com/facebook/osquery/issues/1282)
My main regret with OSQuery is the fact that events data isn’t easily queryable on the host itself (bear with me, I’m explaining my problem)
I’d like to keep a daemon running at all times, catching events, and logging to the RocksDB these things (with expiration of course)
The problem is that osqueryi cannot access the database being used by the daemon, since it’s locked
Would multiple read-only osqueryi’s be possible ?
This would give the ability to query past events from the daemon (for example events between now and a previous observation) instead of having to send to a TLS endpoint, or parsing osqueryd.results.logs
Thanks a lot !