https://github.com/osquery/osquery logo
Join Slack
Powered by
```Expiring events for subscriber: windows_events ...
# general
m
Copy code
Expiring events for subscriber: windows_events (overflowed limit 50000)
z
Looks like you are perhaps not actually selecting against the 
windows_events
table? That would clear out the buffered events into logs which could be shipped off elsewhere.
m
My query is select * from windows_events
But seems to not be emptying the table
a
Ah I see, so you are using events; what's your --events_expiry set at?
m
It seems I have not set an expirey which is likely mu problem
a
It shouldn't be a problem though, event optimization (default enabled) will not return the same data twice, so it won't log duplicates
m
or actually would it be a problem if i'm fetching the events every 10 seconds
a
That message is not an error, just an information
if you wish to use the same table from different queries, it's not ideal to expire everything on the first query
m
Ah yes I see because data will be gone for query 2
bit somehow I am ending up with 50000 entries in the table
does osqueryi and osqueryd share same db?
a
that is normal, without expiration you will keep getting new events added at the end, and expiration will remove them from the start of the queue
once the max amount of events (--events_max), it will remove events on one side as new ones are added to the other side
when using scheduled queries + osqueryd, event optimization will make sure that only new events are added (i.e. you will only log new rows added since the last query)
m
so to alleviate that warning I should set max to say 49000 then?
a
osqueryi and osqueryd are separate
👍 1
it's not a warning, it's just an informational message
everything is working as intended
m
overflowed is usually bad isn't it?
a
if you do not wish to query the same table from multiple queries, you can set the events_expiry so that the first query will remove them
no it's just telling you that it's performing the cleanup, nothing bad is happening
m
oh rightio
it's cleaning up at 50000
17 Views
Open in Slack
PreviousNext
Powered by