osquery-1/specs/utility/osquery_events.table
Teddy Reed 05a795d80a Count subscriber events correctly in osquery_events (#2419)
This also changes the osquery_events API by renaming restarts to refreshes.
2016-08-29 06:57:24 -07:00

17 lines
753 B
Plaintext

table_name("osquery_events")
description("Information about the event publishers and subscribers.")
schema([
Column("name", TEXT, "Event publisher or subscriber name"),
Column("publisher", TEXT, "Name of the associated publisher"),
Column("type", TEXT, "Either publisher or subscriber"),
Column("subscriptions", INTEGER,
"Number of subscriptions the publisher received or subscriber used"),
Column("events", INTEGER,
"Number of events emitted or received since osquery started"),
Column("refreshes", INTEGER, "Publisher only: number of runloop restarts"),
Column("active", INTEGER,
"1 if the publisher or subscriber is active else 0"),
])
attributes(utility=True)
implementation("osquery@genOsqueryEvents")