{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/4745","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/4745/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/4745/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/4745/events","html_url":"https://github.com/facebook/osquery/pull/4745","id":343585409,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAzMTgyNzc0","number":4745,"title":"removing less useful things from logger","user":{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false},"labels":[{"id":165050666,"node_id":"MDU6TGFiZWwxNjUwNTA2NjY=","url":"https://api.github.com/repos/facebook/osquery/labels/API%20change","name":"API change","color":"eb6420","default":false},{"id":135415736,"node_id":"MDU6TGFiZWwxMzU0MTU3MzY=","url":"https://api.github.com/repos/facebook/osquery/labels/RFC","name":"RFC","color":"cc317c","default":false},{"id":117911471,"node_id":"MDU6TGFiZWwxMTc5MTE0NzE=","url":"https://api.github.com/repos/facebook/osquery/labels/bug","name":"bug","color":"fc2929","default":true},{"id":196858822,"node_id":"MDU6TGFiZWwxOTY4NTg4MjI=","url":"https://api.github.com/repos/facebook/osquery/labels/cla%20signed","name":"cla signed","color":"ededed","default":false},{"id":998924279,"node_id":"MDU6TGFiZWw5OTg5MjQyNzk=","url":"https://api.github.com/repos/facebook/osquery/labels/dead%20code","name":"dead code","color":"a5f7c6","default":false}],"state":"open","locked":false,"assignee":{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false},"assignees":[{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-07-23T10:59:54Z","updated_at":"2018-08-01T23:24:57Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/4745","html_url":"https://github.com/facebook/osquery/pull/4745","diff_url":"https://github.com/facebook/osquery/pull/4745.diff","patch_url":"https://github.com/facebook/osquery/pull/4745.patch"},"body":"Removed some capabilities of the osquery logger, which to my understanding did not find any important use case. \r\n\r\n- **No primary logger concept**. - Could not find any important use case for that, considering the fact that, a primary logger is the random one.\r\n- **All the loggers receive statuses**. - All the logger plugins currently implemented, except Kafka one, receive statuses anyway. However, I found one logger, which even though implemented [logStatus](https://github.com/facebook/osquery/blob/master/osquery/logger/plugins/filesystem_logger.cpp#L115) Does not return true for usesLogStatus. (BUG)\r\n- **No logger can ask for events.** - 1. No plugin was doing it anyway. 2. logger.cpp does not look the right place for it. As all it was doing, was subscribing plugin to the event in events.cpp . 3. Because of the high-frequency events, we are already missing the events. Actually serializing and sending it through thrift API will make things even slower.\r\n- **Dead code**: LoggerDisabler was not used.\r\n"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/409757143","html_url":"https://github.com/facebook/osquery/pull/4745#issuecomment-409757143","issue_url":"https://api.github.com/repos/facebook/osquery/issues/4745","id":409757143,"node_id":"MDEyOklzc3VlQ29tbWVudDQwOTc1NzE0Mw==","user":{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false},"created_at":"2018-08-01T23:24:57Z","updated_at":"2018-08-01T23:24:57Z","author_association":"CONTRIBUTOR","body":"@maestretti \r\nThanks for all the information.\r\n\r\nYes, it's a really tempting feature. As I mentioned in practice it should be a very inconvenient one. Events, for example, process ones, happen so fast that we can not even grab them all and we are losing some. Sending raw data over the network and then processing it in the backend, should not be an easy thing. That's why I'm interested if someone really used it in production successfully. \r\n\r\nThe other argument, me, not liking this feature in osquery is that to my understanding it's not the osquery thing. osquery offers table abstraction for the system information. If we want raw data streaming to the backend servers, should we sneak it from logger plugin or should it reside in a completely separate application having nothing to do with either osquery configuration or SQL tables? \r\n\r\nI'd love to hear community feedback on that."}}
{"actor":{"display_login":"guliashvili"}}