Title
#general
Jams

Jams

01/06/2020, 10:55 PM
My understanding of
wall_time
from
osquery_schedule
table is that it’s the unix time difference between the start and end of a query. However, does that imply it’s the difference of when the query was last executed? Further,
system_time
&
user_time
are both milliseconds and I would have to divide by
executions
to understand its performance profile?
theopolis

theopolis

01/06/2020, 11:51 PM
Wall time is the period from the start of executing a query until the end, not last executed.
11:52 PM
System and user time represent time scheduled on the CPU https://en.m.wikipedia.org/wiki/CPU_time#Subdivision
Jams

Jams

01/07/2020, 6:33 PM
Makes sense now