Bacarus08/04/2021, 1:34 PM
, are they related to this use case or are they only for the filesystem logging plugin?
Jocelyn Bothe08/04/2021, 1:38 PM
Bacarus08/04/2021, 2:37 PM
is the flag that I was looking for. The value represents “_the maximum number of logs to buffer before dropping new logs”_ . So there is no way to select a predefined size of the memory used by rocksdb to buffer the logs, I can only play around the number of logs, am I right?
can I have 10 logs per query in the buffer (for a total of 30 logs) ?
Sarah Gillespie08/04/2021, 8:42 PM
represents all logs so in your example you would not be able to have 30 logs. Note that the 10 log limit also includes osquery status logs if you are sending those. You might also try #general to see if folks there have any thoughts 😀