Hi osquery team, could u indicate the code of osquery controlling the the live query / schedule query running serially?

Distributed query waits for jobs is in one thread. Scheduler runs in its own thread. Each thread runs only one query at a time but the two threads may run concurrently with each other. There is no control per se.

well this is different from what i heard.

I believe that is what Stefano was trying to convey.

so let me ask it in this way, can 2 live queries run simultaneously on host?

I do not believe so. One distributed and one scheduled at a time.

so how does osquery implement this.

Yes.

so could u show me the code for details?

osquery/dispatcher/distributed_runner.cpp: Dispatcher::addService(std::make_shared<DistributedRunner>()); osquery/dispatcher/scheduler.cpp: Dispatcher::addService(std::make_shared<SchedulerRunner>(