Add support for scheduled queries to run at startup by Micah-Kolide · Pull Request #8554 · osquery/osquery
This PR adds a new field for scheduled queries startup_priority which if set to a non-default value will run queries in ascending order once osqueryd starts the SchedulerRunner.
I've tested this a fair amount on MacOS, and I've attached time table of my tests showing when osqueryd initialized and when it executed the defined scheduled queries.
Time Table.csv
Here are some logs also showing the example change:
I0219 17:35:35.824323 107137088 dispatcher.cpp:78] Adding new service: SchedulerRunner (0x60000121c558) to thread: 0x17039f000 (0x6000029293c0) in process 25893
I0219 17:35:35.824326 1881698304 eventfactory.cpp:410] Event publisher fsevents run loop terminated for reason: Publisher disabled via configuration
I0219 17:35:35.824347 1882845184 scheduler.cpp:120] Executing scheduled query test_startup_priority_0_int_400: select * from processes
I0219 17:35:35.890591 1882845184 scheduler.cpp:201] Found results for query: test_startup_priority_0_int_400
I0219 17:35:35.890978 1882845184 scheduler.cpp:120] Executing scheduled query test_startup_priority_1_int_120: select * from processes
I0219 17:35:35.942234 1882845184 scheduler.cpp:201] Found results for query: test_startup_priority_1_int_120
I0219 17:35:35.942560 1882845184 scheduler.cpp:120] Executing scheduled query test_startup_priority_1_int_300_1: select * from processes
I0219 17:35:35.990871 1882845184 scheduler.cpp:201] Found results for query: test_startup_priority_1_int_300_1
I0219 17:35:35.991300 1882845184 scheduler.cpp:120] Executing scheduled query test_startup_priority_1_int_300_2: select * from processes
I0219 17:35:36.050416 1882845184 scheduler.cpp:201] Found results for query: test_startup_priority_1_int_300_2
I0219 17:35:36.050863 1882845184 scheduler.cpp:120] Executing scheduled query test_startup_priority_2_int_30_1: select * from processes
I0219 17:35:36.099247 1882845184 scheduler.cpp:201] Found results for query: test_startup_priority_2_int_30_1
...
I0219 17:36:05.949177 1882845184 scheduler.cpp:120] Executing scheduled query test_startup_priority_max_int_60: select * from processes
I0219 17:36:06.005627 1882845184 scheduler.cpp:201] Found results for query: test_startup_priority_max_int_60