https://github.com/osquery/osquery logo
#general
Title
# general
z

Zach Zeid

04/23/2020, 2:06 PM
I'm looking at results from a query and it contains
"action": "removed"
does this mean that it was removed from the table in osquery?
s

seph

04/23/2020, 2:48 PM
That's differential format, instead of snapshots. There should be docs.
z

Zach Zeid

04/23/2020, 3:06 PM
I was reading the paragraph on schedule results where the action denotes a state change. the example provided makes sense, it'll log a state change when the process changes (new PID). This makes less sense to me when I see
"action": "removed"
as a part of querying a target for packages.
s

seph

04/23/2020, 3:06 PM
Why? Was the package removed? Did the version change?
You may want the batch log format, as well
z

Zach Zeid

04/23/2020, 3:10 PM
That was the weird part, the only thing that changed was we were testing a sql query to streamline getting packages. Will look into batch log format.
s

seph

04/23/2020, 3:13 PM
Batch is still diffs, but they're grouped into a single message
3 Views