{"push_id":2704729638,"size":8,"distinct_size":1,"ref":"refs/heads/feature_numeric_monitoring_cache","head":"f76da2b6aa3ef242c6e8ea9a29d228f209775636","before":"30912d761aa31d1ad1b7251f16c2d5d7d7462152","commits":[{"sha":"af647a4251f2c4eefa0df98a2158c876d4b21c7d","author":{"name":"Alexander","email":"dba83e70a642170c75f5650543973cf62e07526f@gmail.com"},"message":"Add `get_or`, `take_or` shortcuts to Expected class (#4662)\n\n* Add get_or, take_or shortcuts to Expected class\r\n* Make take_or more strict with accept types","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/af647a4251f2c4eefa0df98a2158c876d4b21c7d"},{"sha":"53dc36d7352fe990fbb9d81f58e6b30b6a987537","author":{"name":"Javier Marcos","email":"f7a507996e3024b06608abf673df6fa64e29f11f@gmail.com"},"message":"Adding OSX Dummy malware to osx-attacks query pack (#4668)","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/53dc36d7352fe990fbb9d81f58e6b30b6a987537"},{"sha":"f088f26c61e08673f01a1f904a681962909909d8","author":{"name":"Jonathan Keljo","email":"1df79244be6abc71effcee5b7f583065fdc70804@users.noreply.github.com"},"message":"Add documentation for conditional column gen (#4673)","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/f088f26c61e08673f01a1f904a681962909909d8"},{"sha":"1cf5cb7dbc25bf73a8393d1c8f720df0028c278b","author":{"name":"uptycs-nishant","email":"0ce4567aebda3c53860559b7a912dfbfd93a7b88@uptycs.com"},"message":"Fixing user_time, system_time bug and changing the cpu utilization logic (#4431)","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/1cf5cb7dbc25bf73a8393d1c8f720df0028c278b"},{"sha":"9497df67cc31f7760a28c77215438b89deae2115","author":{"name":"Alessandro Gario","email":"5d30f9a27bc5ca5e45207d416ce7556936309b69@users.noreply.github.com"},"message":"Add a new audit-based table to collect SELinux events (#4224)","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/9497df67cc31f7760a28c77215438b89deae2115"},{"sha":"ee65b95f3c1ae3f3dae80d1b323c28319756f2c6","author":{"name":"Teddy Reed","email":"8e253411902717ec585a7911662d2d8f285d52d0@prosauce.org"},"message":"bug: Fix SELinux events rebase (#4684)","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/ee65b95f3c1ae3f3dae80d1b323c28319756f2c6"},{"sha":"1945db71b5cf2f2227d7c1dfe8fdd9bd5a1a3288","author":{"name":"Alexander","email":"dba83e70a642170c75f5650543973cf62e07526f@gmail.com"},"message":"Numeric monitoring system concept (#4626)\n\nJust an interface and simple implementation dumping points to file on disk.\r\nAnd I add also few monitoring records to some places of osquery code as an example.\r\n\r\nBrief\r\nJust an interface and simple implementation dumping points to file on disk.\r\nAnd I add also few monitoring records to some places of osquery code as an example.\r\n\r\nMotivation\r\nosquery can monitor system health. But at some point we need to monitor the condition of osquery itself. Vast majority of interesting parameters can be represented by\r\nnumbers. How many queries it runs, how long does each query takes, what is the performance hit of each query, how long was last downtime and so on and so far. For obviou\r\ns reason it hard to measure most of this parameters by external instrument. And it is almost impossible to evaluate it on production. But we can do it from inside of osquery.\r\n\r\nWhat this PR is for\r\nThe systems like graphite or RRDtool can store and plot time-series data for us. We just have to\r\nbe able to feed data to it. We can create different plugins to be able to send data to different instruments. And we need some proper internal interface to all potential plugins. This PR is attempt to create generic interface.\r\n\r\nInterface description\r\nThe most systems accept data as sequences of 2-dimensional points. One of the dimensions is value, the other is time. Each particular sequence has unique key, to be distinguished from the others.\r\nData descriptions for carbon. I have used this three parameters as an attributes of one monitoring point.\r\n\r\nTo send one point from some particular place in the code you just need to call the function record from namespace monitoring declared in the file include/osquery/num eric_monitoring.h with 3 arguments (path, value, time). Where path is the unique key of sequence; value is some interesting value to watch; time is the time of the point (can be omitted, current system time is the default vaule).","distinct":false,"url":"https://api.github.com/repos/akindyakov/osquery/commits/1945db71b5cf2f2227d7c1dfe8fdd9bd5a1a3288"},{"sha":"f76da2b6aa3ef242c6e8ea9a29d228f209775636","author":{"name":"akindyakov","email":"dba83e70a642170c75f5650543973cf62e07526f@fb.com"},"message":"Merge branch 'master' into feature_numeric_monitoring_cache","distinct":true,"url":"https://api.github.com/repos/akindyakov/osquery/commits/f76da2b6aa3ef242c6e8ea9a29d228f209775636"}]}
{"actor":{"display_login":"akindyakov"}}