And I assume you are using a recent version of osquery Older

Question

And I assume you are using a recent version of osquery Older versions had performance issues on macos specifically with using the users table

Daisukixci · Answer

I m on 4 3 0 I m gonna try what you suggest

Daisukixci · Answer

So limit on history query successfully do the trick but it s the only user over 2K that have the issue do you think it worth opening an issue we probably can privately share the history

theopolis · Answer

I have some ideas on how to improve this table I can generate an example large history and test if the parsing is quicker

theopolis · Answer

One way you can help out tremendously is by building and testing the latest changes after I make them If you have troubling building from source I can provide test packages that are not signed

Daisukixci · Answer

Would be happy to help thanks

Daisukixci · Answer

source should be fine already did it