Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

If I'm doing `select * from shell_history` on a schedule, does that read the whole `.bash_history` every time, or does it diff it in some way?

It would be the whole thing unless you filter on the time column

how would you be able to diff time in a sql statement?

For example, to get the events for the past hour: `select * from shell_history where time &gt; strftime('%s', 'now', '-1 hour');`

See here for SQLite’s date functions <https://www.sqlite.org/lang_datefunc.html>

looks like this is a non-starter because `time` in `shell_history` is reliant on history timestamps enabled
```osquery&gt; select * from users cross join shell_history on shell_history.uid = users.uid where time &gt; strftime('%s', 'now', '-1 minutes');```
doesn't return any results (when there should be.

Didn’t realize bash didn’t include a timestamp by default. Too used to zsh I guess :slightly_smiling_face:

yeah, I turned it on in my bash shell, so it seemingly only works a little bit.