osquery-1/osquery/events
George Guliashvili 96de926d1c Improve event expiration mechanism (#5335)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5335

It was reported that osquery eventing mechanism uses too much disk space. As daebeike found it, event expiring was failing in some cases to be executed.

More specifically, expiration check was supposed to run every time EVENTS_CHECKPOINT number of events where added. However, in between the checks for expiration more than EVENTS_CHECKPOINT events could be added and no expiration would be executed. I suppose, this behaviour would be easily reproducible under the high load

Reviewed By: fmanco

Differential Revision: D13565250

fbshipit-source-id: 78bbad3f7aded4beb9e5f42bafd9184e9c2f8efb
2019-01-14 10:53:47 -08:00
..
benchmarks Move build system to BUCK 2018-12-07 16:12:35 +00:00
darwin fixed headers_namespace to match file path 2019-01-14 03:33:32 -08:00
linux fixed headers_namespace to match file path 2019-01-14 03:33:32 -08:00
tests Make TableRows more abstract 2019-01-09 13:50:15 -08:00
windows Move build system to BUCK 2018-12-07 16:12:35 +00:00
BUCK Introduce TableRow interface 2019-01-09 13:50:15 -08:00
events.cpp Improve event expiration mechanism (#5335) 2019-01-14 10:53:47 -08:00
pathset.h Move build system to BUCK 2018-12-07 16:12:35 +00:00