quick question, I have a query scheduled with differential every 1 min. The result of the query are "PID, cmdline" but why it sends 1 new log every 60 seconds, shouldn't be the same everytime and only receive the first one ?
Same result. I keep getting result every 1 or 2 minutes depend on how I set up the time. Same log is being sent every 2 minutes. The log has only PID, and cmdLine, nothing else. Not sure how this is treated as a new log every time.
07/19/2022, 3:35 PM
Hmm, what type of information are you trying to receive with running a differential query on an events table?
07/19/2022, 3:36 PM
I'm getting a process id (PID) and cmdLine from it.
so I assume it should be the same PID and same cmdLine every time it runs, and I need to receive only one copy of it, as long as it's the same PID and cmdLine.
07/19/2022, 3:52 PM
If you look at the data in the logs, what kind of changes are you seeing?
07/19/2022, 5:56 PM
don’t apply to evented tables (
) in this case — they behave the same way as snapshot
07/19/2022, 7:57 PM
didn't know that.
so in that case, how long should I have my query scheduled for so the previous event is not returned. In another words, how long does it take for the event to be flushed from the local machine ?
07/20/2022, 10:41 AM
tables, by default events are buffered locally for 24 hours…but that buffered is cleared when selecting from that table..The query you are using above might complicate this a bit, since there is a subquery to the same
and there is a
constraint on the table — can you try to explain what that query is trying to do, maybe there is a better way to structure that query..?
07/25/2022, 5:09 PM
Hello @sharvii thanks for your reply. What I'm trying to do is finding a certain command "cmdLine" and get the parent file that executed this command. Please let me know if there is a better way of doing this.Assume a file called test.sh executed a command called "ifconfig", then I need to get the "test.sh" file by finding the command it executed "ifconfig"