https://github.com/osquery/osquery logo
Title
p

packetzero

12/20/2018, 6:54 PM
i was going to rig up a script to parse schedule and packs in config and determine the ideal event_expiry. Before I do, has anyone already done this?
u

钢铁侠

12/21/2018, 7:26 AM
so how can you get the ideal event_expiry by parse schedule and packs in config?
p

packetzero

12/21/2018, 2:58 PM
ideal is probably the wrong word. I guess the 'minimum' is what we are looking for. Ideally, the event_expiry=1 so they are expired right after SELECT-ing them. However, you may have several queries referencing an event table, you have to consider their intervals, and how long the queries take, and the 'events_optimize' behavior.