another advantage in implementing this in an extension is that your table won't get killed if osquery misbehave; the worker will just restart and your extension will connect back to it
p
puffycid
10/23/2021, 7:58 PM
so if the extension is in the middle crawling the file system and the extension is killed it will restart where it was killed and continue?
a
alessandrogario
10/23/2021, 8:13 PM
if osquery is killed by the watchdog, it won't even notice if osquery restarts correctly