valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: Move the schedule_max_drift description into docs (#6003)

Browse Source
This commit is contained in:
Teddy Reed 2019-11-06 23:34:55 -05:00 committed by GitHub
parent 3c3c7a7d29
commit 11ae5a21b0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/wiki/installation/cli-flags.md
View File

@ -265,6 +265,13 @@ Percent to splay config times.
The query schedule often includes several queries with the same interval. The query schedule often includes several queries with the same interval.
It is often not the intention of the schedule author to run these queries together at that interval. But rather, each query should run at about the interval. A default schedule splay of 10% is applied to each query when the configuration is loaded. It is often not the intention of the schedule author to run these queries together at that interval. But rather, each query should run at about the interval. A default schedule splay of 10% is applied to each query when the configuration is loaded.
`--schedule_max_drift=60`
Max time drift in seconds.
The scheduler tries to compensate the splay drift until the delta exceeds this value.
If the max drift is exceeded the splay will be reseted to zero and the compensation process will start from the beginning.
This is needed to avoid the problem of endless compensation (which is CPU greedy) after a long SIGSTOP/SIGCONT pause or something similar. Set it to zero to disable drift compensation.
`--pack_refresh_interval=3600` `--pack_refresh_interval=3600`
Query Packs may optionally include one or more discovery queries, which allow Query Packs may optionally include one or more discovery queries, which allow

10
osquery/dispatcher/scheduler.cpp
View File

@ -31,15 +31,7 @@ namespace osquery {
FLAG(uint64, schedule_timeout, 0, "Limit the schedule, 0 for no limit"); FLAG(uint64, schedule_timeout, 0, "Limit the schedule, 0 for no limit");
FLAG(uint64, FLAG(uint64, schedule_max_drift, 60, "Max time drift in seconds");
schedule_max_drift,
60,
"Max time drift in seconds. Scheduler tries to compensate the drift until "
"the drift exceed this value. After it the drift will be reseted to zero "
"and the compensation process will start from the beginning. It is needed "
"to avoid the problem of endless compensation (which is CPU greedy) after "
"a long SIGSTOP/SIGCONT pause or something similar. Set it to zero to "
"switch off a drift compensation. Default: 60");
FLAG(uint64, FLAG(uint64,
schedule_reload, schedule_reload,