@Mustafa any

_events

tables will be collecting events as long as

osqueryd

is running, and then when you query them you will get all the events since the last query was executed.

Yes, we have already been using windows_events table. Sorry for this but i think i couldn't explain the situation exactly. What i asked for is about non-event based tables. For example when i query usb_events table periodically, the result of the query doesn't contain the events/logs which generated between the any two queries

Is there a

usb_events

table? I can only find

usb_devices

which is not event based. There is also

hardware_events

which is event based.

Zwass thank you for the correction.

usb_devices

gives you the state when the query is run