Ivanlei
08/23/2019, 11:04 PMevents_expiry
flag is used during SELECT
to expire "old" events out of rocksdb. if i have a query like SELECT * FROM file_events where target_path not like '/etc/blkid%'
will events for stuff under /etc/blkid
be expired from rocksdb?b0l
08/24/2019, 3:26 PMIvanlei
08/26/2019, 12:57 PMzwass
09/04/2019, 9:57 PMfile_events
) that are older than the configured events_expiry
will be expired. Separately, if events_optimize
is turned on (on by default), that specific query will skip results it has already seen on the next run.b0l
09/05/2019, 8:43 PMzwass
09/05/2019, 11:16 PMevents_expiry
to 1 second will cause the events to expire after every query. If only one query is hitting the table that can be a good strategy for keeping the caches cleared. If multiple queries hit that table you are likely to have problems.b0l
09/06/2019, 8:01 AM