Can I double check the differences in logging opti...
# fleetj
JJ
09/10/2025, 10:25 AMCan I double check the differences in logging options for Queries? I'm currently collecting Event Logs via FleetDM with a Query and want to ensure the no logs or removed or overwritten and are continually building. I currently have it on snapshot and have a feeling some rows are being replaced/deleted? What do I need to change it to?
u
Unthread
09/10/2025, 1:21 PMhey @JJ - a member of the team will follow up with you shortly!
Unthread
09/10/2025, 2:22 PMHI @JJ! There is a built-in mechanism in osquery that clears events after a scheduled query has been run. You can change the default behavior using osquery flags:https://osquery.readthedocs.io/en/stable/installation/cli-flags/#events-control-flagsI do recommend using caution when changing the behavior as you may see a noticeable performance impact on the host and/or denylisting of your queries as the buffer increases.
11 Views