osquery-1/specs/last.table

table_name("last")
description("System logins and logouts.")
schema([
    Column("username", TEXT, "Entry username"),
    Column("tty", TEXT, "Entry terminal"),
    Column("pid", INTEGER, "Process (or thread) ID"),
    Column("type", INTEGER, "Entry type, according to ut_type types (utmp.h)"),
    Column("time", INTEGER, "Entry timestamp"),
    Column("host", TEXT, "Entry hostname"),
])
attributes(cachable=True)
implementation("last@genLastAccess")
Adding `last` virtual table 2014-09-04 22:20:28 +00:00			`table_name("last")`
Add more table descriptions for API generation 2015-02-09 01:40:35 +00:00			`description("System logins and logouts.")`
Adding `last` virtual table 2014-09-04 22:20:28 +00:00			`schema([`
Adding description to all the missing table fields 2015-07-16 06:23:42 +00:00			`Column("username", TEXT, "Entry username"),`
			`Column("tty", TEXT, "Entry terminal"),`
Adding description to columns 2015-02-10 02:18:22 +00:00			`Column("pid", INTEGER, "Process (or thread) ID"),`
Adding description to all the missing table fields 2015-07-16 06:23:42 +00:00			`Column("type", INTEGER, "Entry type, according to ut_type types (utmp.h)"),`
			`Column("time", INTEGER, "Entry timestamp"),`
			`Column("host", TEXT, "Entry hostname"),`
Adding `last` virtual table 2014-09-04 22:20:28 +00:00			`])`
Table results caching 1. Table implementations (spec files) can mark the table as 'cachable'. 2. Cached results depend on the shortest/quickest interval of scheduled queries that act on results of the table. 3. The table API generator blocks caching on index/additional/required table column options. 2015-11-09 02:31:50 +00:00			`attributes(cachable=True)`
Removing old code for generating virtual tables 2014-10-14 04:58:26 +00:00			`implementation("last@genLastAccess")`