osquery data lifetime in log file

[hemasalma]

Hello,

I have installed osquery in my lab... it is working fine..

when we run the conf file the data regarding the queries are stored in the log file..

and here can I know what is the life period of logs i.e., the data in the log file... do we have any such cases here?

[salmajohnysk]

Can any one give replay for the above question please......

[muffins]

@hemasalma @salmajohnysk are you referring to how long is the results data stored? This sounds like a question for osquery (github.com/facebook/osquery), where as this repo is for tracking the Python extensions specifically.

To your question -- osquery leverages a local rocks.db instance for caching results for the purpose of computing differential results, however this is not where query results that you want in your backend are stored. There's a number of configuration settings for one to decide where/when/how long the osquery results are handled detailed on our readthedocs here: https://osquery.readthedocs.io/en/stable/deployment/logging/

Hope that answers your question! I'm going to close this issue out, but please feel free to re-open if you have more questions :)