Daisukixci
06/24/2020, 3:24 PMJun 22 12:35:33 xxxxxxx osqueryd[198]: osqueryd worker (82507) stopping: Memory limits exceeded: 222240768
I may have determined that this is linked to his bash history (SELECT * from users JOIN shell_history using (uid);
) because when we move it somewhere else and create a new one, the log doesn’t appear again. His history is 4.5MB, I don’t know if it’s too big (guess not but saying it just in case). Any thing we try to do to find the root cause without deleting his all history ?theopolis
07/14/2020, 1:14 AMshell_history
. https://github.com/osquery/osquery/pull/6541Daisukixci
07/15/2020, 8:16 AM