Title
#general
Bacarus

Bacarus

08/03/2021, 2:55 PM
Hi, I’m trying to use the schedule_epoch flag but it doesn’t work as I expect. First of all, does the value passed by schedule_epoch flag to osquey represent the time (expressed in seconds) between an epoch to the next one or is it like an identifier of a specific epoch? scheduling a differential query with
interval: 10
What I would like to achieve: • A first query to store initial results for the new scheduled query (some rows with 
action: "added"
  ) • if the query detects some changes every 10 seconds (the field
counter
is increased each time a query is executed in this epoch) • After 600 seconds (10 minutes) the epoch changes, counter is reseted to 0 and a new “first” query to store initial results (the rows with
action: "added"
mentioned before) is executed
s

seph

08/03/2021, 4:00 PM
The schedule epoch is an arbitrary string that is used to reset the counter and diff results,
4:01 PM
First diff results is, inherently, a full set. Subsequent diffs are based off that.
4:01 PM
Changing the epoch causes a new set of diffs.
4:01 PM
Note that it’s an arbitrary string, not an increment or decrement. Also that the epoch is for the entire device, not a specific query
4:02 PM
I think that’s the behavior of counter — it is incremented when there are results to send. Not when the query is executed. (this was a change sometime in 4.x)
4:03 PM
osquery does not have functionality to change the epoch. That’s the responsibility of the TLS server. Note that as its host-wide, changing it every 10 minuntes may not be desired.
4:03 PM
Depending on your needs, another approach is to schedule both snapshot and diff queries. They’re good for different things. (but exist apart from eachother)
Bacarus

Bacarus

08/04/2021, 7:49 AM
Perfect, thank you for your explanation. I confirm your thought the counter is increased only when there are results to send (I’ve just tried it with osquery 4.8.0)