Francisco Huerta04/28/2022, 7:19 AM
file that grows in size very quickly. Ideally, the size of the results file should be kept under control.
• I configured the -
and associated options to keep a maximum number of files and their respective sizes in a predictive way (e.g., 10 files of up to 250MiB each). This works well and I see the files created correctly, moving the older ones to the
• The actual problem is once I hit the total limits (maximum number of files and archives). As stated in the documentation, osquery drops the overflowing events. As much as this being the designed behaviour, I would expect the possibility for osquery to manage the housekeeping of the existing files, giving the choice of working as stated before -i.e., dropping any new events-, or automatically rotating the files, deleting the older ones and always logging newer events.
• Furthermore, in the documentation, it is mentioned the possibility of older files to be removed but I’m not quite getting how this can be enabled… or if I’m interpreting this correctly. The actual reference in https://osquery.readthedocs.io/en/stable/installation/cli-flags/ is under the `--logger_rotate_max_files = 25`: “_[…] If a rotation happens after hitting this max, the oldest file will be removed_.“.
So, the questions, after such long explanations, are: is rotated logs deletion delegated to external tools (as suggested, e.g.,, in here ? What are the recommended best practices in multi-OS environments (e.g., use task manager + cron)? Is there any chance this option to be incorporated into osquery e.g., as an extra flag to the baseline
Gavin04/28/2022, 11:51 AM
What events are you referring to here ?
I've set osquery to log all events from a Windows machine in the local filesystem as the only output
Stefano Bonicatti04/28/2022, 1:00 PM
the log file are "separate" in the sense that they come into action when there's a query that retrieves the events and which causes the logger to write the rows as results in the files.
Stefano Bonicatti04/28/2022, 1:02 PM
Francisco Huerta04/28/2022, 1:28 PM
Francisco Huerta04/28/2022, 1:39 PM
and the respective
files. Then, I stop seeing any new events flowing to the central collection platform.
Francisco Huerta04/28/2022, 1:41 PM