valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

monitor number of times osquery starts (#5171)

Browse Source
This commit is contained in:
Giorgi Guliashvili 2018-09-04 14:05:11 +01:00 committed by GitHub
parent 2cfaf8aa94
commit f903ec02bc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/osquery/killswitch.h
View File

@ -31,6 +31,10 @@ class Killswitch : private boost::noncopyable {
public:
virtual ~Killswitch();
// Author: @guliashvili
// Creation Time: 3/09/2018
bool isAppStartMonitorEnabled();
// Author: @guliashvili
// Creation Time: 3/09/2018
bool isExecutingQueryMonitorEnabled();

4
osquery/core/init.cpp
View File

@ -699,6 +699,10 @@ void Initializer::start() const {
FLAGS_numeric_monitoring_plugins);
}
if (Killswitch::get().isAppStartMonitorEnabled()) {
monitoring::record("osquery.start", 1, monitoring::PreAggregationType::Sum);
}
// Start event threads.
osquery::attachEvents();
EventFactory::delay();

4
osquery/killswitch/killswitch.cpp
View File

@ -32,6 +32,10 @@ FLAG(string,
Killswitch::Killswitch() {}
Killswitch::~Killswitch() = default;
bool Killswitch::isAppStartMonitorEnabled() {
return isNewCodeEnabled("appStartMonitorSwitch");
}
bool Killswitch::isExecutingQueryMonitorEnabled() {
return isNewCodeEnabled("executingQueryMonitorSwitch");
}