Fix event expiration to prevent losing events #8535
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes osquery#8524 by ensuring the last events are never expired from a table. Without this change, new event IDs could be unintentionally generated starting from 1, while optimizations tell the generate function to look at a higher ID. All of those newer events would then never be logged.
Comment on lines
+364
to
+366
| // Events are expired after being queried (except for last valid event -- | ||
| // optimize should take care of that event not being returned again, but that | ||
| // is tested separately below.) |
Member
There was a problem hiding this comment.
I don't really understand how optimize prevents it from being returned. Or how this tests it.
Member
Author
There was a problem hiding this comment.
Optimization keeps track of the highest eventid and then when the generate function is called any event with a lower ID is skipped when returning rows. The test for optimization verifies that behavior.
directionless
approved these changes
Jan 23, 2025
Member
|
@alessandrogario Can you review this? |
Member
|
@zwass What was the conclusion here? I know you talked for awhile at Office Hours about this. Is it ready for merge? |
Member
Author
|
I believe it's ready but I am hoping that @alessandrogario will review it because it's deep in the events code. |
Member
Author
|
Going ahead and merging. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #8524 by ensuring the last events are never expired from a table. Without this change, new event IDs could be unintentionally generated starting from 1, while optimizations tell the generate function to look at a higher ID. All of those newer events would then never be logged.