Title
#core
marpaia

marpaia

03/27/2018, 8:59 PM
it would be nice if these strings (records in this case) things could immediately be passed to the logging subsystem. kind of like https://github.com/facebook/osquery/pull/3482 but not specific to tls.
a

alessandrogario

03/27/2018, 9:02 PM
Didn’t know you could do this, I’ll look into it. Would this become something that you toggle on and off or something that is always enabled (removing the table)?
marpaia

marpaia

03/27/2018, 9:08 PM
i would love to just be able to configure a subscription to an event publisher via options and get a stream of logs to the logger plugin
9:08 PM
maybe as a new event type
9:09 PM
the best you can do now is
select *
the table with
removed: false
9:09 PM
but that still has to go through the interval of the scheduler, diff logic after getting the results out of rocksdb, etc
9:12 PM
rocksdb should still be involved for the durability of process restarts, network failure, etc but i think a lot of the rest of it can be peeled back and added to the logging subsystem directly in a plugin agnostic way
a

alessandrogario

03/27/2018, 9:13 PM
uhm so each log line would be a complete row?
marpaia

marpaia

03/27/2018, 9:13 PM
either a
Row
or a
QueryData
presumably
a

alessandrogario

03/27/2018, 9:15 PM
That would be cool, and would probably speed up a lot of simple tables
marpaia

marpaia

03/27/2018, 9:16 PM
yeah, i think it would work well for higher throughput event publishers
9:16 PM
probably a micro-optimization for something like
usb_devices
9:17 PM
but for audit or ebpf, it seems like it would be a fair bit more efficient to marry these two systems together