Juan Alvarez
06/04/2021, 4:46 PMMike Myers
06/04/2021, 6:25 PMJuan Alvarez
06/04/2021, 6:42 PMallister
06/07/2021, 12:48 AMseph
06/08/2021, 8:13 PMallister
06/09/2021, 12:45 AMseph
06/09/2021, 1:45 AMpuffycid
06/23/2021, 3:42 AMallister
06/23/2021, 4:43 AMseph
06/23/2021, 3:38 PMpuffycid
08/03/2021, 5:49 PMseph
08/03/2021, 6:05 PMpuffycid
08/03/2021, 6:10 PMseph
08/03/2021, 6:10 PMpuffycid
08/16/2021, 2:25 AMJuan Alvarez
10/29/2021, 10:35 AMMike Myers
10/29/2021, 7:21 PMselect * from log
in a way that might cause osquery to run too long / collect too much / get its worker process terminated by its watchdog process. I think the consensus was that we needed some way to prevent this. I'm just relaying what the conversation was and the status of that.Daniel Bretón Suárez
05/03/2022, 3:25 PMMike Myers
05/03/2022, 8:58 PMDaniel Bretón Suárez
05/04/2022, 3:42 PMMike Myers
05/04/2022, 4:01 PMLIMIT
in SQL but I'm not sure if it's applied before osquery gathers the data, or after. If after, then osquery still tries to get all data first, which is what we're trying to avoid. I like the idea of a new CLI flag. This could be in a blueprint issue, as it probably applies equally to other types of log fetch queries.Stefano Bonicatti
05/04/2022, 6:45 PMLIMIT
applies afterJOIN
is involved, because then sqlite will call the table logic multiple timesDaniel Bretón Suárez
05/05/2022, 7:40 AMStefano Bonicatti
05/05/2022, 8:27 AMDaniel Bretón Suárez
05/05/2022, 2:22 PMStefano Bonicatti
05/06/2022, 10:55 AMDaniel Bretón Suárez
05/09/2022, 8:54 AMallister
05/20/2022, 9:42 AMDaniel Bretón Suárez
05/23/2022, 10:36 AMMike Myers
05/24/2022, 5:12 PMDaniel Bretón Suárez
05/26/2022, 12:52 PM