{"action":"opened","number":4647,"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/4647","id":197635143,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk3NjM1MTQz","html_url":"https://github.com/facebook/osquery/pull/4647","diff_url":"https://github.com/facebook/osquery/pull/4647.diff","patch_url":"https://github.com/facebook/osquery/pull/4647.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/4647","number":4647,"state":"open","locked":false,"title":"Improving audit-based performances","user":{"login":"alessandrogario","id":5714290,"node_id":"MDQ6VXNlcjU3MTQyOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/5714290?v=4","gravatar_id":"","url":"https://api.github.com/users/alessandrogario","html_url":"https://github.com/alessandrogario","followers_url":"https://api.github.com/users/alessandrogario/followers","following_url":"https://api.github.com/users/alessandrogario/following{/other_user}","gists_url":"https://api.github.com/users/alessandrogario/gists{/gist_id}","starred_url":"https://api.github.com/users/alessandrogario/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alessandrogario/subscriptions","organizations_url":"https://api.github.com/users/alessandrogario/orgs","repos_url":"https://api.github.com/users/alessandrogario/repos","events_url":"https://api.github.com/users/alessandrogario/events{/privacy}","received_events_url":"https://api.github.com/users/alessandrogario/received_events","type":"User","site_admin":false},"body":"This PR adds support for write batching to the database plugins and the events framework. \r\n\r\nWe spent some time profiling osqueryd with perf, and the patch should remove RocksDB from the hot path, making Audit-based tables (process_events/user_events/sockets_events/process_file_events) a lot more reliable and faster.\r\n\r\nWhen using the `system_stress.py` script on my system with a factor of 9, CPU usage went down from 80~90% to 20% max. Another key difference is that the machine never feels unresponsive now.\r\n\r\nI would really love to get some feedback on this patch, and hear what you think!\r\n","created_at":"2018-06-27T07:08:09Z","updated_at":"2018-06-27T07:08:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/4647/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/4647/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/4647/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/a527ada1efcae350c2c482547573f6c24d72941f","head":{"label":"trailofbits:alessandro/feature/audit-performance-improvements","ref":"alessandro/feature/audit-performance-improvements","sha":"a527ada1efcae350c2c482547573f6c24d72941f","user":{"login":"trailofbits","id":2314423,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzMTQ0MjM=","avatar_url":"https://avatars0.githubusercontent.com/u/2314423?v=4","gravatar_id":"","url":"https://api.github.com/users/trailofbits","html_url":"https://github.com/trailofbits","followers_url":"https://api.github.com/users/trailofbits/followers","following_url":"https://api.github.com/users/trailofbits/following{/other_user}","gists_url":"https://api.github.com/users/trailofbits/gists{/gist_id}","starred_url":"https://api.github.com/users/trailofbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trailofbits/subscriptions","organizations_url":"https://api.github.com/users/trailofbits/orgs","repos_url":"https://api.github.com/users/trailofbits/repos","events_url":"https://api.github.com/users/trailofbits/events{/privacy}","received_events_url":"https://api.github.com/users/trailofbits/received_events","type":"Organization","site_admin":false},"repo":{"id":98204498,"node_id":"MDEwOlJlcG9zaXRvcnk5ODIwNDQ5OA==","name":"osquery-pr","full_name":"trailofbits/osquery-pr","owner":{"login":"trailofbits","id":2314423,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzMTQ0MjM=","avatar_url":"https://avatars0.githubusercontent.com/u/2314423?v=4","gravatar_id":"","url":"https://api.github.com/users/trailofbits","html_url":"https://github.com/trailofbits","followers_url":"https://api.github.com/users/trailofbits/followers","following_url":"https://api.github.com/users/trailofbits/following{/other_user}","gists_url":"https://api.github.com/users/trailofbits/gists{/gist_id}","starred_url":"https://api.github.com/users/trailofbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trailofbits/subscriptions","organizations_url":"https://api.github.com/users/trailofbits/orgs","repos_url":"https://api.github.com/users/trailofbits/repos","events_url":"https://api.github.com/users/trailofbits/events{/privacy}","received_events_url":"https://api.github.com/users/trailofbits/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/trailofbits/osquery-pr","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/trailofbits/osquery-pr","forks_url":"https://api.github.com/repos/trailofbits/osquery-pr/forks","keys_url":"https://api.github.com/repos/trailofbits/osquery-pr/keys{/key_id}","collaborators_url":"https://api.github.com/repos/trailofbits/osquery-pr/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/trailofbits/osquery-pr/teams","hooks_url":"https://api.github.com/repos/trailofbits/osquery-pr/hooks","issue_events_url":"https://api.github.com/repos/trailofbits/osquery-pr/issues/events{/number}","events_url":"https://api.github.com/repos/trailofbits/osquery-pr/events","assignees_url":"https://api.github.com/repos/trailofbits/osquery-pr/assignees{/user}","branches_url":"https://api.github.com/repos/trailofbits/osquery-pr/branches{/branch}","tags_url":"https://api.github.com/repos/trailofbits/osquery-pr/tags","blobs_url":"https://api.github.com/repos/trailofbits/osquery-pr/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/trailofbits/osquery-pr/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/trailofbits/osquery-pr/git/refs{/sha}","trees_url":"https://api.github.com/repos/trailofbits/osquery-pr/git/trees{/sha}","statuses_url":"https://api.github.com/repos/trailofbits/osquery-pr/statuses/{sha}","languages_url":"https://api.github.com/repos/trailofbits/osquery-pr/languages","stargazers_url":"https://api.github.com/repos/trailofbits/osquery-pr/stargazers","contributors_url":"https://api.github.com/repos/trailofbits/osquery-pr/contributors","subscribers_url":"https://api.github.com/repos/trailofbits/osquery-pr/subscribers","subscription_url":"https://api.github.com/repos/trailofbits/osquery-pr/subscription","commits_url":"https://api.github.com/repos/trailofbits/osquery-pr/commits{/sha}","git_commits_url":"https://api.github.com/repos/trailofbits/osquery-pr/git/commits{/sha}","comments_url":"https://api.github.com/repos/trailofbits/osquery-pr/comments{/number}","issue_comment_url":"https://api.github.com/repos/trailofbits/osquery-pr/issues/comments{/number}","contents_url":"https://api.github.com/repos/trailofbits/osquery-pr/contents/{+path}","compare_url":"https://api.github.com/repos/trailofbits/osquery-pr/compare/{base}...{head}","merges_url":"https://api.github.com/repos/trailofbits/osquery-pr/merges","archive_url":"https://api.github.com/repos/trailofbits/osquery-pr/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/trailofbits/osquery-pr/downloads","issues_url":"https://api.github.com/repos/trailofbits/osquery-pr/issues{/number}","pulls_url":"https://api.github.com/repos/trailofbits/osquery-pr/pulls{/number}","milestones_url":"https://api.github.com/repos/trailofbits/osquery-pr/milestones{/number}","notifications_url":"https://api.github.com/repos/trailofbits/osquery-pr/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/trailofbits/osquery-pr/labels{/name}","releases_url":"https://api.github.com/repos/trailofbits/osquery-pr/releases{/id}","deployments_url":"https://api.github.com/repos/trailofbits/osquery-pr/deployments","created_at":"2017-07-24T15:13:56Z","updated_at":"2018-05-17T10:19:56Z","pushed_at":"2018-06-27T06:58:42Z","git_url":"git://github.com/trailofbits/osquery-pr.git","ssh_url":"git@github.com:trailofbits/osquery-pr.git","clone_url":"https://github.com/trailofbits/osquery-pr.git","svn_url":"https://github.com/trailofbits/osquery-pr","homepage":"https://osquery.io","size":15283,"stargazers_count":3,"watchers_count":3,"language":"C++","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":1,"open_issues":0,"watchers":3,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"e2a53388b8118e330ab4f81acf09fecc6d043f23","user":{"login":"facebook","id":69631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY5NjMx","avatar_url":"https://avatars3.githubusercontent.com/u/69631?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"node_id":"MDEwOlJlcG9zaXRvcnkyMjM5NDM1Nw==","name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY5NjMx","avatar_url":"https://avatars3.githubusercontent.com/u/69631?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/facebook/osquery/deployments","created_at":"2014-07-29T20:27:33Z","updated_at":"2018-06-27T07:02:09Z","pushed_at":"2018-06-27T00:23:19Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":15259,"stargazers_count":12618,"watchers_count":12618,"language":"C++","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1479,"mirror_url":null,"archived":false,"open_issues_count":266,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":1479,"open_issues":266,"watchers":12618,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/4647"},"html":{"href":"https://github.com/facebook/osquery/pull/4647"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/4647"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/4647/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/4647/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/4647/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/a527ada1efcae350c2c482547573f6c24d72941f"}},"author_association":"CONTRIBUTOR","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":2,"additions":490,"deletions":121,"changed_files":22}}
{"actor":{"display_login":"alessandrogario"}}