valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[Fix #3931] Remove removed results correctly (#3938)

Browse Source
This commit is contained in:
Teddy Reed 2017-11-18 15:21:11 -08:00 committed by GitHub
parent 8e10156a1f
commit 523ad777a8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
osquery/dispatcher/scheduler.cpp
View File

@ -127,16 +127,17 @@ inline void launchQuery(const std::string& name, const ScheduledQuery& query) {
diff_results.added = std::move(sql.rows());
}
if (query.options.count("removed") && !query.options.at("removed")) {
diff_results.removed.clear();
}
if (diff_results.added.empty() && diff_results.removed.empty()) {
// No diff results or events to emit.
return;
}
VLOG(1) << "Found results for query: " << name;
item.results = diff_results;
if (query.options.count("removed") && !query.options.at("removed")) {
item.results.removed.clear();
}
item.results = std::move(diff_results);
status = logQueryLogItem(item);
if (!status.ok()) {