https://github.com/osquery/osquery logo
#core
Title
# core
b

Brad Girardeau

01/07/2023, 1:02 AM
Hi the docs on the "events_expiry" flag say that events are only expired right after being queried (or if the max events buffered limit is hit), which seems great to avoid missing events even if a host goes offline temporarily. When I was looking at the code, it seemed like there are a couple other places where cleanup is done: when new events are received and on set up. Is this expected? I haven't been able to test the behavior yet, so it's possible I'm misreading, but I want to make sure we're setting the expiry time correctly to avoid losing events.