Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
z
Zach Zeid
09/17/2020, 3:04 PMshould it be included in the rule packs?
t
theopolis
09/17/2020, 8:05 PMHere is an example query to monitor
osquery_schedulez
Zach Zeid
09/17/2020, 10:52 PMThanks! I think I'm misunderstanding how the query works, as just running it with
osqueryijust running this from
osqueryiselect name, interval, executions, output_size, wall_time, (user_time/executions) as avg_user_time, (system_time/executions) as avg_system_time, average_memory, last_executed from osquery_schedule;
+-------------------------------+----------+------------+-------------+-----------+---------------+-----------------+----------------+---------------+
| name | interval | executions | output_size | wall_time | avg_user_time | avg_system_time | average_memory | last_executed |
+-------------------------------+----------+------------+-------------+-----------+---------------+-----------------+----------------+---------------+
| installed_homebrew_packages_1 | 14400 | 0 | 0 | 0 | | | 0 | 0 |t
theopolis
09/18/2020, 2:28 AMCorrect, it would have to be a scheduled query. Since
osqueryiosquerydz
Zach Zeid
09/18/2020, 1:06 PMI added this query from the example above, but all it does it report information on itself, but not other queries?
I think I understand, it'll only report something after the queries are executed.