You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is the issue noted in #76. Keeping all historical results of
queries in the HistoricalQueryResults struct makes serializing and
deserializing those structs very, very slow as time goes on. By only
storing the last execution of the query, we keep the performance
constant, but we kill the feature where osquery can rebuild timelines
without accessing logs. After talking it over, we decided that this
isn't actually that big of a deal because, if you really wanted to
rebuild the old data, you should be able to process the logs, similarly
to bin log replication in MySQL.
Serializing into a
HistroicalQurtyResult
type is slower than it should be. Make sure the scheme is correct. If necessary, break it into multiple keys in the column family and use thrift's serialization to store it (http://techblog.ridewithvia.com/post/37118173720/take-care-when-serializing-and-deserializing-thrift).The text was updated successfully, but these errors were encountered: