Zach Zeid
05/15/2020, 5:32 PMselect * from shell_history
on a schedule, does that read the whole .bash_history
every time, or does it diff it in some way?sundsta
05/15/2020, 5:35 PMZach Zeid
05/15/2020, 5:39 PMsundsta
05/15/2020, 5:39 PMWHERE
clauseZach Zeid
05/15/2020, 5:41 PMsundsta
05/15/2020, 5:46 PMselect * from shell_history where time > strftime('%s', 'now', '-1 hour');
Zach Zeid
05/15/2020, 5:53 PMtime
in shell_history
is reliant on history timestamps enabled
osquery> select * from users cross join shell_history on shell_history.uid = users.uid where time > strftime('%s', 'now', '-1 minutes');
doesn't return any results (when there should be.sundsta
05/20/2020, 5:55 PMZach Zeid
05/20/2020, 6:27 PM