And I assume you are using a recent version of osquery? Older versions had performance issues on macos, specifically with using the users table.
d
Daisukixci
06/26/2020, 8:46 AM
I’m on 4.3.0. I’m gonna try what you suggest
Daisukixci
07/02/2020, 1:42 PM
So “limit” on history query successfully do the trick but it’s the only user over 2K that have the issue, do you think it worth opening an issue ? we probably can privately share the history
t
theopolis
07/02/2020, 3:08 PM
I have some ideas on how to improve this table. I can generate an example large history and test if the parsing is quicker.
theopolis
07/02/2020, 3:09 PM
One way you can help out tremendously is by building and testing the latest changes (after I make them). If you have troubling building from source I can provide test packages that are not signed.