Hi team have a question on osquery distributed write interfa

Question

Hi team have a question on osquery distributed write interface I am a beginner so please excuse me if this is a naive question so I am using following interfaces to communicate with osqeryd process I am getting the result returned by osqueryd and sending it to an api whenever post to api fails next time I read results it will accumulate previously failed results even though I am just feeding in 1 query I want to know is it caching those results and if yes can I configure the caching on osqueryd side Thanks ```GetQueriesFunc WriteResultsFunc```

seph · Answer

When you say you re using those interfaces what exactly do you mean

Pooja K · Answer

using GetQueriesFunc interface to send queries to osqueryd service to process and calling WriteResultsFunc to get results back from the daemon

seph · Answer

What library What SDK What software

seph · Answer

Osquery itself does not really do caching It runs a query and returns results Evented tables are a bit weird they source events and generally only run queries on data newer than the last run

Pooja K · Answer

I am using `osquery 5 1 0 1 linux x86 64 tar gz`

Pooja K · Answer

can I see the logs interacting with this interface

seph · Answer

I have no idea what interface you re using

Pooja K · Answer

oh bdw I am running simple `select time now ` query

seph · Answer

How are you communicating with osquery

Pooja K · Answer

so I am using my own extension to run with osqueryd which basically communicates with osqueryd using extensio socket

Pooja K · Answer

seph · Answer

What SDK was my next question

seph · Answer

A go extension communicating over the extension socket is important information

seph · Answer

Neither the go SDK nor osquery are doing caching When your extension triggers a distributed query osquery will execute it and return the results

seph · Answer

Rereading your question there s something there about how logs are handled If osquery cannot send it s log they will be buffered until the configured logging destination can accept them

seph · Answer

The distributed interface there is a bit of an odd choice But maybe it s what you intend

Pooja K · Answer

Thanks for explaining this Seph let me check more on my side ang will get back to you if needed thanks