06/25/2020, 3:58 PM
And I assume you are using a recent version of osquery? Older versions had performance issues on macos, specifically with using the users table.
06/26/2020, 8:46 AM
I’m on 4.3.0. I’m gonna try what you suggest
So “limit” on history query successfully do the trick but it’s the only user over 2K that have the issue, do you think it worth opening an issue ? we probably can privately share the history
07/02/2020, 3:08 PM
I have some ideas on how to improve this table. I can generate an example large history and test if the parsing is quicker.
One way you can help out tremendously is by building and testing the latest changes (after I make them). If you have troubling building from source I can provide test packages that are not signed.
07/02/2020, 3:10 PM
Would be happy to help, thanks
source should be fine, already did it