Commit Graph

147 Commits

Author SHA1 Message Date
Teddy Reed
e9500c218c freebsd: Update provision script for CI (#3112) 2017-03-26 23:53:06 -07:00
Teddy Reed
bc85f726ad events: Execute schedule before expiring (#3091) 2017-03-21 12:38:04 -07:00
Teddy Reed
7b6d026820 rocksdb: Update to 5.0 and use DeleteRange for expirations (#3066) 2017-03-17 12:40:07 -07:00
Teddy Reed
bd88d0059a rocksdb: Set a max size for RocksDB MANIFEST logs (#3065) 2017-03-13 20:35:07 -07:00
Jonathan Lee
a1de136c1a Change logging level in certain cases (#2896) 2017-01-31 08:07:42 -08:00
lambda-conjecture
88d9ae8a3d Handle corrupted rocksdb database (#2884) 2017-01-27 16:21:07 -08:00
Teddy Reed
58ed5cc628 Introduce scheduler reload feature (#2917) 2017-01-25 17:48:33 -08:00
lambda-conjecture
721dd1ed62 Fix column order and repeated columns in distributed query (#2926) 2017-01-20 22:52:47 -08:00
Teddy Reed
f9599d60d0 Move Mutex to shared_timed_mutex and add ReadLock (#2915) 2017-01-15 02:16:40 -08:00
Teddy Reed
0e9733f94c Simplify Registry and plugin concepts (#2887) 2017-01-07 12:21:35 -08:00
Teddy Reed
272771acb8 Improve RocksDB thread usage and write stalls (#2835) 2016-12-07 20:20:40 -08:00
lambda-conjecture
cd761d1749 Fix deadlock in RocksDB log callback (#2749) 2016-12-02 23:24:08 -08:00
Teddy Reed
59f0bad67c Additional compiler checks, including shadow (#2486) 2016-11-06 01:17:04 -08:00
Teddy Reed
e775fe1ea2 [Fix #2579] Remove database_in_memory flag (#2716) 2016-11-03 09:55:10 -07:00
Teddy Reed
ef10e93d60 Improve scheduled/differential query performance and logging (#2476) 2016-09-19 16:45:13 -07:00
yying
84e6a3401a Reducing compiler warnings and fails on warn in VS (#2433) 2016-09-02 15:04:03 -07:00
Teddy Reed
65dd56e113 Introduce table 'attributes' (#2431) 2016-08-31 15:32:20 -07:00
Teddy Reed
d6e20279d8 Use LOG(INFO) and set INFO as default logging mode (#2420)
This is fairly important, it changes the default mode for what status
events are logged to INFO. It had been set to WARNING and INFO was relatively
unused.

This also removes expected support for RocksDB 'in-memory' databases.
If a shell-user requests a database via CLI flags it will now work.
2016-08-31 15:09:01 -07:00
Teddy Reed
7c1ecc6871 Brew-based build redesign (#2251) 2016-07-31 11:32:31 -07:00
yying
0ef284b8e7 Changes to make osqueryd/osqueryi mostly build sans cputime/uptime tables (#2283) 2016-07-25 11:58:55 -07:00
yying
2fb3797c53 Changes to support building a osquery Windows service. (#2278) 2016-07-22 13:29:37 -07:00
Teddy Reed
5be180a8f9 Swap removed and added for logs (#2260) 2016-07-20 12:25:10 -07:00
artemdinaburg
78e1cf7ab4 Transition __attribute__((constructor)) to a more platform independent approach (#2233) 2016-07-14 14:19:33 -07:00
Teddy Reed
45530c0496 Slight performance improvments (#2242) 2016-07-12 19:16:50 -07:00
Teddy Reed
6852122af9 Force RocksDB to sync writes for non-event domains (#2228)
RocksDB is the default "database" plugin. Writes are normally kept in an
in-memory memtable. Writes that are not part of the event pubsub system can
be forced to sync to disk.
2016-07-07 14:08:12 -07:00
Ryan Holeman
88053a08b4 Optional top level decorator functionality (#2177) 2016-07-06 15:31:59 -07:00
artemdinaburg
e6fbde820e Windows Daemon/Shell: Make osquery code more Windows-friendly (#2188) 2016-07-01 14:56:07 -07:00
Nick Anderson
cf30388705 Moved test_utils to it's own directory out of core. Updated references (#2154) 2016-06-09 10:49:26 -07:00
Teddy Reed
10664a4945 Add --ephemeral for daemons and disable shell events (#2111)
This changes several initialization steps:
- The daemon (and shell, though not needed) have a new --ephemeral flag.
- Events are now disabled in the shell by default, use --nodisable_events to
  re-enable.
- RocksDB-based backing storage is now disabled in the shell by default.

The --ephemeral flag for the daemon is disabled by default and will allow
skipping configuration and database path sanity, and skipping pidfile checks.
This is intended to be used when debugging or monitoring the daemon process.

To make the RocksDB backing storage feature usage very clear we introduce a new
flag: --disable_database. The shell sets this to true unless overridden in
a flagfile or via command line arguments.
2016-05-20 08:39:04 -07:00
Teddy Reed
57c6b2a521 Revive the OS X kernel-based publishers (#2083)
The OS X kernel subscribers have not been starting because they expect the
publisher thread to run before they begin configuration. Due to some recent
refactors the publisher thread creation now occurs after configuration.

The subscriber logic to check for a valid kernel connection is still valid.

This commit has two additional side-effects:
- The RocksDB plugin is modified to use 3 background merge threads.
- The OS X kernel publisher syncing thread is now non-blocking.
2016-05-11 11:47:42 -07:00
Teddy Reed
9053a1f125 Include decorations within results events (#2068)
Currently, the decorations are applied to statuses and results in batch format.
This seems like an oversight, decorations should be on all results.
2016-05-05 13:19:10 -07:00
Teddy Reed
b6f09a7ecb Add action for snapshot query results (#2061) 2016-05-03 11:16:22 -07:00
Teddy Reed
2379493721 Introduce decorator queries 2016-03-29 10:03:50 -07:00
Teddy Reed
621f1bd3a9 [Fix #1896] Gate additional and kernel tests/benchmarks 2016-03-15 23:05:37 -07:00
Teddy Reed
afd17f8134 1. Reorganize RocksDB database handle into a plugin
2. Introduce a SQLite-based database plugin
3. Refactor database usage to include local 'fast-calls'
4. Introduce an 'ephemeral' database plugin for testing (like a mock)
2016-03-06 20:40:16 -08:00
Baraa Hamodi
21c2237eca [osquery] Update copyright headers to new format. 2016-02-11 11:48:58 -08:00
Teddy Reed
f05cc345d3 Add an events_max limit for event buffering 2016-02-01 08:38:58 -08:00
Teddy Reed
87ea41c6ec Improve TLS logger performance 2016-01-21 10:43:15 -08:00
Teddy Reed
d6e91c81e9 Improve TLS logging memory 2016-01-15 00:22:31 -08:00
Teddy Reed
7c38cf17d9 Add support for make packages on Debian 2016-01-07 23:50:31 -08:00
Teddy Reed
360ac54688 Remove num_levels explicit definition for RocksDB 2015-12-21 15:27:34 -08:00
Teddy Reed
c5766da6d0 [#1518] Only emit a single line for each logString 2015-12-16 16:42:55 -08:00
Teddy Reed
5a66d5b838 Move RocksDB logs to INFO 2015-12-16 14:36:12 -08:00
Teddy Reed
3004df5a50 Use custom logger for RocksDB 2015-12-15 20:49:33 -08:00
Teddy Reed
fef53fa0d0 Add config and database dumping to stdout 2015-12-06 11:01:26 -08:00
Teddy Reed
4c2319f8dd Add GID to PrivilegeDropper 2015-11-08 01:03:08 -08:00
Teddy Reed
cd4de8023f Merge pull request #1630 from theopolis/fix_1626
[Fix #1626] Add schedule blacklist and protect DBHandle
2015-11-03 21:05:29 -08:00
Teddy Reed
edea3d6edd [Fix #1626] Add schedule blacklist and protect DBHandle 2015-11-03 20:50:22 -08:00
Teddy Reed
5728c93392 Remove specific filenames from RocksDB IOErrors 2015-11-02 15:12:52 -08:00
Teddy Reed
402490e75b Attempt to improve DB/query performance 2015-11-02 10:57:01 -08:00