https://github.com/osquery/osquery logo
Title
v

vaar

06/09/2020, 2:16 PM
if osquery runs a scheduled query and the tls endpoint is not reachable at that time, the results are sent as soon as the connection to the tls endpoint is estabilished?
s

seph

06/09/2020, 2:44 PM
Yes. osquery buffers logs until it can send them. I don’t remember what the max amount buffered is, but it should handle some outage
👍 1
v

vaar

06/09/2020, 2:51 PM
and if the host is turned off, the schedule will start from the osquery process start time or the missing scheduled query are resumed?
s

seph

06/09/2020, 3:07 PM
What host? If the endpoint is turned off, there is nothing missed. If the logging destination is offline, the logs are bugged until they can be sent.
v

vaar

06/09/2020, 3:08 PM
I mean, the host where osquery is running
if a scheduled query was planned for the next 5 min and the machine is off, the query is just missed? or it will run after 5 minutes from the osuqery process start time?
s

seph

06/09/2020, 3:09 PM
If the host is turned off, than what is missing?
v

vaar

06/09/2020, 3:12 PM
let's say that there is scheduled query every 12 hours (12 hours is calculated from the osquery process start time), so afther 10 hours the machine is turned off and than come back after 5, so the scheduled query is just skipped. So now that the machine is online again, the scheduled query runs after 12 hours from the osquery process start, or what?
z

Zach Zeid

06/09/2020, 3:14 PM
I believe the scheduled query happens from the time the osqueryd service is running
so it's be the query runs 12 hours after the osqueryd process is started.
v

vaar

06/09/2020, 3:15 PM
so, the query is scheduled again after 12 hours
s

seph

06/09/2020, 3:22 PM
It should run roughly every 12h of uptime.
I’d have to double check code or docs.
z

zwass

06/09/2020, 4:45 PM
The schedule will restart with the osquery process start time. If the host is sleeping (so the osquery process is not terminated), no "time" passes in the schedule.