Creating many SST files was a problem with an earlier versio

Question

Creating many SST files was a problem with an earlier version of osquery are you running a recent version

Mike Myers · Answer

Juan Alvarez · Answer

we are running 4 6 0

Juan Alvarez · Answer

saw that before github issue before but i understood it would not apply to 4 6 0

theopolis · Answer

Are you comfortable sharing your db with me to debug

Juan Alvarez · Answer

i cant share it unfortunately disappointed Is there any steps i could take to debug

Juan Alvarez · Answer

we have seen that at some point we created many powershell events that were included there pretty big ones I have disabled powershell events now but would that not cleanup de db

Juan Alvarez · Answer

that table was never queried tho it was enabled in the flags

theopolis · Answer

That could be it osquery will store the last 50k by default then start removing batches

Juan Alvarez · Answer

older SST files do never get deleted or should it remove them

Juan Alvarez · Answer

finally i reproduced the symptoms locally and uploaded a database dump i have created this <https github com osquery osquery issues 7079>