osquery-1/osquery/dispatcher
Seshu Pasam 6fab8b6083 logging: adding "counter" to differentiate initial results (#3651)
When setting up alerts for differential logs data you might want to skip the
initial added records. counter can be used to identify if the added records
are all records from initial query of if they are new records. For initial
query results that includes all records counter will be "0". For subsequent
query executions counter will be incremented by 1. When epoch changes, counter
will be reset back to "0".
2017-09-07 15:01:15 -07:00
..
tests config: Rename getInstance to get for consistency (#3350) 2017-05-28 23:04:53 -07:00
CMakeLists.txt cleanup: Move query out of database header (#3576) 2017-08-20 02:44:38 -07:00
dispatcher.cpp Triaging windows auto load extensions; (#3384) 2017-06-09 10:35:40 -07:00
distributed.cpp [Fix #2704] Various distributed code cleanups (#2719) 2016-11-03 23:54:55 -07:00
distributed.h Move dispatcher to public API 2016-03-21 15:27:51 -07:00
scheduler.cpp logging: adding "counter" to differentiate initial results (#3651) 2017-09-07 15:01:15 -07:00
scheduler.h Introduce table 'attributes' (#2431) 2016-08-31 15:32:20 -07:00