https://github.com/osquery/osquery logo
Title
z

zhong

02/02/2022, 5:49 PM
Hi all, I had a quick question about query packs, how does
Frequency
affect certain queries in the packs?
t

Tomas Touceda

02/02/2022, 8:50 PM
hi there, the frequency defines how often a query runs in seconds. Fleet abstracts the idea of a scheduled query, which is how osquery identifies a query to be ran in a host. In osquery terms, it's called an interval. Here's an example and more details about it: https://osquery.readthedocs.io/en/stable/deployment/configuration/#query-packs does that make sense?
z

zhong

02/02/2022, 9:57 PM
Thanks for the reply and yes it does! so in this case that certain query would be running 3600 times in a second on each host? Would a frequency like 3600 cause the query pack to run significantly slower?
t

Tomas Touceda

02/02/2022, 10:06 PM
so in this case that certain query would be running 3600 times in a second on each host?
it would run every 3600 seconds
z

zhong

02/02/2022, 10:06 PM
ah i see thank you