Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update docs: _changes tables are not evented #7762

Merged
merged 1 commit into from
Sep 13, 2022
Merged

Update docs: _changes tables are not evented #7762

merged 1 commit into from
Sep 13, 2022

Conversation

zhumo
Copy link
Contributor

@zhumo zhumo commented Sep 6, 2022

Ran across this as I was learning about the eventing framework.

@zhumo zhumo requested review from a team as code owners September 6, 2022 17:46
@mike-myers-tob
Copy link
Member

Yea, it looks like the only table named something_changes is this Docker table, and its implementation is not event-driven.

osquery/osquery/tables/applications/posix/docker.cpp

Line 739 in a18ffee

* @brief Entry point for docker_container_fs_changes table.

With regard to "every" or "almost every", are there any event-driven tables that are not named "something_events"?

@mike-myers-tob mike-myers-tob added ready for review Pull requests that are ready to be reviewed by a maintainer documentation labels Sep 6, 2022
@mike-myers-tob mike-myers-tob changed the title update docs: _changes tables are not evented. Update docs: _changes tables are not evented Sep 6, 2022
@zhumo
Copy link
Contributor Author

zhumo commented Sep 8, 2022 •
edited

@mike-myers-tob I did a search through the code, the only .table file with event_subscriber=True is the examples table, which I think doesn't count.

directionless
directionless approved these changes Sep 8, 2022
View reviewed changes
Copy link
Member

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems fine. If we discover a counter example we can revert it.

@mike-myers-tob mike-myers-tob merged commit acbfaf1 into osquery:master Sep 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@directionless directionless directionless approved these changes

Assignees
No one assigned
Labels
documentation ready for review Pull requests that are ready to be reviewed by a maintainer
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@zhumo @mike-myers-tob @directionless