Hello, when I use osquery to monitor file integrit...
# general
d
Hello, when I use osquery to monitor file integrity, the query log result often appears a duplicate paragraph. Have you ever encountered this kind of situation?
m
perhaps the events are not expired from the table's backing store when they are picked up again by the next query? It may happen when the query interval is shorter than the expiration time. I made a recent update to the documentation around this here: https://osquery.readthedocs.io/en/latest/installation/cli-flags/#events-control-flags
d
Thank you for your help