I know that osqueryd and osqueryi do not interact with one another (like watchdog can't kill osqueryi if it's running a performance heavy query). However, do the two share the RocksDB embedded database? I ask because we have

select * from osquery_schedule;

as a scheduled query and can see the results being returned in elasticsearch but if we try to do that query in

osqueryi

the fields are zeroed out.

They do not share the RocksDB database. Only one process may have RocksDB open at one time.

I figured this might be the case. We have events disabled but does osquery not store the metrics for

osquery_schedule

in the database?

When you start osqueryi there will be no schedule. I'm not sure there's a good way to look at the

osquery_schedule

table besides as a scheduled query or a live query against a running osqueryd.

Yeah. I understand what it's doing now after Seph said it's keeping the metrics in memory and then I went through and read some of the code in the repo. Makes sense! Thank you!