if osquery runs a scheduled query and the tls endpoint is not reachable at that time, the results are sent as soon as the connection to the tls endpoint is estabilished?
s
seph
06/09/2020, 2:44 PM
Yes. osquery buffers logs until it can send them. I don’t remember what the max amount buffered is, but it should handle some outage
👍 1
v
vaar
06/09/2020, 2:51 PM
and if the host is turned off, the schedule will start from the osquery process start time or the missing scheduled query are resumed?
s
seph
06/09/2020, 3:07 PM
What host? If the endpoint is turned off, there is nothing missed.
If the logging destination is offline, the logs are bugged until they can be sent.
v
vaar
06/09/2020, 3:08 PM
I mean, the host where osquery is running
if a scheduled query was planned for the next 5 min and the machine is off, the query is just missed? or it will run after 5 minutes from the osuqery process start time?
s
seph
06/09/2020, 3:09 PM
If the host is turned off, than what is missing?
v
vaar
06/09/2020, 3:12 PM
let's say that there is scheduled query every 12 hours (12 hours is calculated from the osquery process start time), so afther 10 hours the machine is turned off and than come back after 5, so the scheduled query is just skipped. So now that the machine is online again, the scheduled query runs after 12 hours from the osquery process start, or what?
z
Zach Zeid
06/09/2020, 3:14 PM
I believe the scheduled query happens from the time the osqueryd service is running
so it's be the query runs 12 hours after the osqueryd process is started.
v
vaar
06/09/2020, 3:15 PM
so, the query is scheduled again after 12 hours
s
seph
06/09/2020, 3:22 PM
It should run roughly every 12h of uptime.
I’d have to double check code or docs.
z
zwass
06/09/2020, 4:45 PM
The schedule will restart with the osquery process start time. If the host is sleeping (so the osquery process is not terminated), no "time" passes in the schedule.