https://github.com/osquery/osquery logo
s

sp

10/13/2021, 5:01 PM
thanks for the replies. So the sql queries are hitting rocksdb to fetch the data ?
z

zwass

10/13/2021, 5:02 PM
Mostly no. Tables named
_events
are hitting rocksdb for the data. Everything else generates it on-the-fly. See "Virtual Tables" and "Event System" in the above linked article.
s

sp

10/13/2021, 5:03 PM
Oh, so the only way to get the history is looking at logs (added, removed etc). I was thinking osquery is like a timeseries which collects metrics and stores in rocksdb