If I m doing `select from shell history` on a schedule does

Question

If I m doing `select from shell history` on a schedule does that read the whole ` bash history` every time or does it diff it in some way

sundsta · Answer

It would be the whole thing unless you filter on the time column

Zach Zeid · Answer

filter

sundsta · Answer

Use a `WHERE` clause

Zach Zeid · Answer

how would you be able to diff time in a sql statement

sundsta · Answer

For example to get the events for the past hour `select from shell history where time gt strftime s now 1 hour `

sundsta · Answer

See here for SQLite s date functions <https www sqlite org lang datefunc html>

Zach Zeid · Answer

thank you I ll look into this

Zach Zeid · Answer

looks like this is a non starter because `time` in `shell history` is reliant on history timestamps enabled ```osquery gt select from users cross join shell history on shell history uid = users uid where time gt strftime s now 1 minutes ``` doesn t return any results when there should be

sundsta · Answer

Didn t realize bash didn t include a timestamp by default Too used to zsh I guess slightly smiling face

Zach Zeid · Answer

yeah I turned it on in my bash shell so it seemingly only works a little bit