Hey, is it possible for osqueryi to use the same database (using database flag) and query events which are registered in it via osqueryd ? So, instead of scheduling queries in osqueryd, can I use osqueryi to execute queries on event based tables ? Provided, osqueryd is configured correctly and is both osqueryd and osqueryi are using same database. Any comments ?
07/26/2018, 9:14 AM
This is not possible as the DB can't be open by two processes at the same time. It would also raise other issues with concurrency as we don't have transactions.
07/26/2018, 10:17 AM
Ok, Thanks. I tried the same and new process threw error : Rocksdb open failed.