https://github.com/osquery/osquery logo
#general
Title
# general
c

Chris Benninger

02/17/2021, 5:53 PM
is there anything under the hood happening that might be undesirable by having a decorator query that could be failing 100% of the time on a given host?
z

zwass

02/17/2021, 6:04 PM
It's probably fine. You're still getting scheduled query results? You might be getting some errors in the status logs, but I wouldn't effect any significant issue.
c

Chris Benninger

02/17/2021, 6:11 PM
ok. IIRC it seemed like the queries were being executed in a queue. The decorators were mixed in the same queue under the hood.
Then if one of the queries in the queue failed, it would interfere with queries later in the queue?
like restarting the queue potentially
z

zwass

02/17/2021, 6:18 PM
Hmm, that does seem plausible but I can't remember off the top of my head.
It is common for folks to push different decorator configs to different platforms using their config management software, Fleet, etc.
c

Chris Benninger

02/17/2021, 6:20 PM
Right that has been our use-case. But we have an internal system that cannot do it, and I’m trying to figure out an exact reason for not just naively giving out the decorators
5 Views