👋 one of our user have an issue with performance spike and a recurrent log

Jun 22 12:35:33 xxxxxxx osqueryd[198]: osqueryd worker (82507) stopping: Memory limits exceeded: 222240768

I may have determined that this is linked to his bash history (

SELECT * from users JOIN shell_history using (uid);

) because when we move it somewhere else and create a new one, the log doesn’t appear again. His history is 4.5MB, I don’t know if it’s too big (guess not but saying it just in case). Any thing we try to do to find the root cause without deleting his all history ?

Hi @Daisukixci, I looked into this and I think I have a solution for the memory impact of

shell_history

. https://github.com/osquery/osquery/pull/6541

Hi, Thanks, gonna test it and provide feedback.