history

Documentation

Index

• func InitHistory(db *bbolt.DB) error
• type ExpectedAtLeastOneRowError
  • func (e ExpectedAtLeastOneRowError) Error() string
• type History
• type Instance
  • func GetHistory() ([]Instance, error)
  • func LatestInstance() (Instance, error)
  • func NewInstance() (*Instance, error)
  • func (i *Instance) Connected(querier Querier) error
  • func (i *Instance) Exited(exitError error) error
• type NoDbError
  • func (e NoDbError) Error() string
• type NoInstancesError
  • func (c NoInstancesError) Error() string
• type Querier

Functions

func InitHistory

func InitHistory(db *bbolt.DB) error

InitHistory loads the osquery instance history from bbolt DB if exists, sets up bucket if it does not

Types

type ExpectedAtLeastOneRowError

type ExpectedAtLeastOneRowError struct{}

func (ExpectedAtLeastOneRowError) Error

func (e ExpectedAtLeastOneRowError) Error() string

type History

type History struct {
	sync.Mutex
	// contains filtered or unexported fields
}

type Instance

type Instance struct {
	StartTime   string
	ConnectTime string
	ExitTime    string
	Hostname    string
	InstanceId  string
	Version     string
	Error       string
}

func GetHistory

func GetHistory() ([]Instance, error)

GetHistory returns the last 10 instances of osquery started / restarted by launcher, each start / restart cycle is an entry

func LatestInstance

func LatestInstance() (Instance, error)

LatestInstance returns the latest osquery instance

func NewInstance

func NewInstance() (*Instance, error)

NewInstance adds a new instance to the osquery instance history and returns it

func (*Instance) Connected

func (i *Instance) Connected(querier Querier) error

Connected sets the connect time and instance id of the current osquery instance

func (*Instance) Exited

func (i *Instance) Exited(exitError error) error

InstanceExited sets the exit time and appends provided error (if any) to current osquery instance

type NoDbError

type NoDbError struct{}

func (NoDbError) Error

func (e NoDbError) Error() string

type NoInstancesError

type NoInstancesError struct{}

func (NoInstancesError) Error

func (c NoInstancesError) Error() string

type Querier

type Querier interface {
	Query(query string) ([]map[string]string, error)
}