Title
#macos
theopolis

theopolis

06/25/2020, 3:58 PM
And I assume you are using a recent version of osquery? Older versions had performance issues on macos, specifically with using the users table.
Daisukixci

Daisukixci

06/26/2020, 8:46 AM
I’m on 4.3.0. I’m gonna try what you suggest
1:42 PM
So “limit” on history query successfully do the trick but it’s the only user over 2K that have the issue, do you think it worth opening an issue ? we probably can privately share the history
theopolis

theopolis

07/02/2020, 3:08 PM
I have some ideas on how to improve this table. I can generate an example large history and test if the parsing is quicker.
3:09 PM
One way you can help out tremendously is by building and testing the latest changes (after I make them). If you have troubling building from source I can provide test packages that are not signed.
Daisukixci

Daisukixci

07/02/2020, 3:10 PM
Would be happy to help, thanks
3:11 PM
source should be fine, already did it