https://github.com/osquery/osquery logo
#plugins
Title
# plugins
t

theopolis

09/09/2020, 1:28 PM
It’s mainly a performance issue, the extensions API requires a bit of serialization and deserialization and the rate of publishing events can be intense.
s

Seshu

01/11/2021, 9:29 PM
@theopolis looking at some of the extensions, events are modeled as regular tables. So they are taking the performance hit anyway if the query is scheduled frequently. Would avoiding JSON and using thrift union, etc help with performance issues?
2 Views