07/18/2020, 9:18 AM
I am making a curl request to
If the osquery db and osquery pid is in
folder, I see some inconsistency in the number of record in
table Sometimes there is only 1 entry and sometimes there are 2 entries for every curl request If I change the path to a permanent location then I see only one entry per curl request


07/18/2020, 5:06 PM
How many tests have you run? I’d recommend trying 1000 to 10000 times using the permanent location first. The Linux audit system that provides the data for this table is not lossless. I suspect confounds in the OS and audit vs. a bug in the handling of DB and pidfile placement.


07/20/2020, 7:15 AM
I have run it 3-4 times and the results are inconsistent Let me look into it
8:34 AM
This is what I was facing on mac system osquery is managed remotely with config plugin as tls There is a query for table
Everytime this query is changed, I am getting an extra events in socket_events table It started with 1 and then increased to 6 events per curl request. Attached csv has data for two curl requests and 1st time count was 5 and second time it was 6.
8:36 AM
I tried with osquery 4.3.0