https://github.com/osquery/osquery logo
Title
a

Ananda Uppalapati

02/13/2020, 7:28 PM
hello all. we have the following for file_events in our config and I was wondering the the default is for interval.I feel 10 sec is too frequent and generating a lot of logs as it's querying every 10 seconds. whats a reasonable number to use?
"file_events": {
          "query": "SELECT * FROM file_events;",
          "interval": 10,
          "description": "File events collected from file integrity monitoring",
          "removed":false
z

zwass

02/13/2020, 7:28 PM
I'd consider 10 seconds to be reasonable... Remember that the events are being recorded in real time anyway. The 10 second interval is just how often the already recorded events will be logged.
a

Ananda Uppalapati

02/13/2020, 7:31 PM
ok thanks