if osquery runs a scheduled query and the tls endpoint is not reachable at that time, the results are sent as soon as the connection to the tls endpoint is estabilished?
06/09/2020, 2:44 PM
Yes. osquery buffers logs until it can send them. I don’t remember what the max amount buffered is, but it should handle some outage
06/09/2020, 2:51 PM
and if the host is turned off, the schedule will start from the osquery process start time or the missing scheduled query are resumed?
06/09/2020, 3:07 PM
What host? If the endpoint is turned off, there is nothing missed.
If the logging destination is offline, the logs are bugged until they can be sent.
06/09/2020, 3:08 PM
I mean, the host where osquery is running
if a scheduled query was planned for the next 5 min and the machine is off, the query is just missed? or it will run after 5 minutes from the osuqery process start time?
06/09/2020, 3:09 PM
If the host is turned off, than what is missing?
06/09/2020, 3:12 PM
let's say that there is scheduled query every 12 hours (12 hours is calculated from the osquery process start time), so afther 10 hours the machine is turned off and than come back after 5, so the scheduled query is just skipped. So now that the machine is online again, the scheduled query runs after 12 hours from the osquery process start, or what?
06/09/2020, 3:14 PM
I believe the scheduled query happens from the time the osqueryd service is running
so it's be the query runs 12 hours after the osqueryd process is started.
06/09/2020, 3:15 PM
so, the query is scheduled again after 12 hours
06/09/2020, 3:22 PM
It should run roughly every 12h of uptime.
I’d have to double check code or docs.
06/09/2020, 4:45 PM
The schedule will restart with the osquery process start time. If the host is sleeping (so the osquery process is not terminated), no "time" passes in the schedule.