Howdy! Random question: How does the osquery daemon handle scheduling queries if a computer goes offline or if a computer is put to sleep in the middle of query execution? So for example, if I have a query interval set to
(once a day) and just before the query is set to run, the computer goes offline for x number of days...how does the daemon handle rescheduling the query when it’s back up?
01/08/2019, 10:49 PM
Depends on what you mean by "offline". If you mean off the network, the query will execute as usual and the results will be buffered until it is online to write results. The osquery scheduler works on "ticks", which means that the query will execute just after the computer comes back from sleep. If the computer shuts down, the interval will restart when it comes back up.