Macear
07/10/2020, 11:07 AMCptOfEvilMinions
07/10/2020, 5:28 PM--events_optimize=true
apply optimizations when `SELECT`ing from events-based tables, enabled by default. - Events you select with your slimed down query will be. deleted.
--events_expiry
the lifetime of buffered events in seconds with a default value of 86000. - This option should expire ALL events after the threshold is met
--events_max
the maximum number of events to store in the buffer before expiring them with a default value of 1000 - So only 1000 events will be stored in RocksDB.osquery events optimization
Macear
07/10/2020, 6:37 PMCptOfEvilMinions
07/10/2020, 7:18 PM--events_expiry=1
and set --events_max=1,000
this combination would keep the RocksDB from eternally growing.
A quick test case would be to enable process monitoring with --events_expiry=1
and set --events_max=10
and then do:
SELECT * FROM process_events
Macear
07/11/2020, 7:40 AM