Hi , does anybody know if the buffered events are sent in any specific order? In example, i have some hundreds agents collecting events (in this case, collecting from the

syslog_events

table). osquery is configured to send to a tls endpoint, and the tls endpoint stops working for 3 hours. Once the tls endpoint is responsive again, osquery starts sending data but, will it come in any order? Will it start sending older events first and newer after? Or will the order be random? Thanks!

It will restart sending them in the order of the oldest first

and will priorize them over the new ones? In example, if i have a constant 100EPS, will it send the older ones when it has room to do so?

It’s not a matter of prioritization, there’s a single queue of JSON serialized events that gets sent to the TLS service. Keep in mind though that this order is based on when the events has been serialized in the DB which might not be the same order of when it actually has been generated

i see, so while there are still pending events to send, the new events will keep getting added to the queue, and will only be sent after all the older events are sent.

yes

understood, thanks!