@seph what do you mean? I am trying to open History db, but it is locked by Chrome/Chomium so I can't run ATC queries. the only way is to copy the file

quickly testing, I think I’m wrong about this. But sqlite dbs can also be in WAL mode, which tends to behave similarly.

@seph see this, I was able to get it working https://osquery.slack.com/archives/CBMR0L7SM/p1562864571064300

Did you avoid the file copy?

Yes - just targeted the current users' Chrome history file and it worked fine. (With Chrome open and in use)

Interesting.

When I manually open the db using the sqlite shell, and attempt to run a query, I get

Error: database is locked