Does `shell history` support differentials E g if I m runnin

Question

Does `shell history` support differentials E g if I m running osqueryd and it runs the following query every 15m `SELECT sh time uid username sh history file sh command FROM users JOIN shell history sh USING uid ` will i get differentials or will i get the entire history contents each time unless i add a `WHERE` condition thats something like `WHERE sh time gt NOW lt QUERY INTERVAL gt `

Ryan · Answer

good question I also would like to know this slightly smiling face

joren · Answer

< zwass> would you be so kind to bequeath some knowledge on me slightly smiling face

seph · Answer

Why wouldn t it support differentials

joren · Answer

i just recall from days of old that it didnt

joren · Answer

and theres a few tables that are like that

terracatta · Answer

It will enumerate all the contents of shell history and if diff mode is enabled only send an update if there is more shell history

terracatta · Answer

and the diff mode behavior should match the behavior of other tables that produce many rows

joren · Answer

good to know slightly smiling face still holds true if `time = 0` e g not properly set

terracatta · Answer

yeah I don t believe osquery is doing anything extra smart other than reading the history files directly and parsing them it s not like maintaining a cursor and remembering when you queried last or anything like that

terracatta · Answer

and if a user or malware deletes the shell history very common or modifies it osquery will just report back what it finds or nothing if it was deleted

terracatta · Answer

I would also just be careful in general mass querying this data if you have a lot of terminal usage you will inadvertently pick up credentials in clear text not everyone is good at using interactive password prompts or will accidentally paste passwords keys etc

terracatta · Answer

Risk Reward on this table is tenuous at best

joren · Answer

thanks < terracatta> slightly smiling face

Ryan · Answer

good tips thanks

zwass · Answer

Yep agreed < terracatta> has it all right