-
Notifications
You must be signed in to change notification settings - Fork 103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
move osquery history to knapsack #2104
Conversation
…ns through history. compiles but tests are not updated yet
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice Work!
@@ -375,14 +375,21 @@ func (i *OsqueryInstance) Launch() error { | |||
return fmt.Errorf("starting osqueryd process: %w", err) | |||
} | |||
|
|||
stats, err := history.NewInstance(i.registrationId, i.runId) | |||
if err != nil { | |||
osqHistory := i.knapsack.OsqueryHistory() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why can't we use i.history
here instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oop because I was waffling on whether to keep i.history at all and then never updated, I will get this cleaned up next. thank you!
There were a few aspects of our history manipulation patterns that were encouraging racy behavior that was going to become even more difficult to maintain while adding additional osquery instances for tracking.
A few changes here should help clear this up a lot:
OsqueryHistorian
interface which takes responsibility for all history manipulation and reading.Instances
directly (we typically translate intomap[string]string
for any reporting anyway). exposing copies like this removes the possibility of reaching directly into instances like that going forward, and avoids overcomplicating the interfaces with pointer receivers on the instancesSetConnected
andSetExited
methods for callers to invoke by instance run id for any updatesNot in Scope Here/future work
history.Instance
to be internal only now (not exported). I did not do that here because I forgot until the end, the changeset was already big and I had already tested this as is. It can be a quick follow on improvement thoughTest Updates
Manual testing performed
launcher_info
table correctly reports latest instance id from historykolide_launcher_osquery_instance_history
table correctly reports the expected historykolide_launcher_osquery_instance_history
shows that exit and errors are correctly being set, as well as connect time for new instancesplease note if there are other things you think i've missed and should test