Tools · Endpoint visibility · 07 / 25
osqueryd: added and removed are changes in the result
action added means the row was not in the previous result. action removed means it left that result. Neither line says why, and the first run marks every current row added.
The line is a diff against the last result
A scheduled query logs how its result changed. action added means that column set was not in the previous result for this query on this host. action removed means it was there last time and is not now. The columns object is the row that appeared or disappeared. The line does not include the SQL; the query name points at the schedule entry, which is what you file beside it.
hostIdentifier is the identifier the daemon was configured to send. unixTime is the clock to quote. The human calendar string is the same moment written out, not a second event.
The first run is a baseline, not a burst of change
The first time a query executes, every current row is logged as added, because there was no previous result to compare. A new host, a new query name, or a wiped osquery database produces that flood. Write “baseline” on that batch. Do not open an incident per line.
After that, a quiet interval with no lines means the result did not change. It does not mean the host was checked by a person.
Removed does not carry a reason
A removed line can be a process exit, a package upgrade that replaced the version column, a config edit, or a restart that changed a pid. The log will not tell you which. Pair a removed line with an added line that shares the stable columns, such as the package name or the binary path, before you say something was uninstalled.
If you cannot find that pair, the note says the row left the result and the cause was not in this log.
Worked case: nginx removed and added two seconds apart
lab-db-01 logs a removed row for nginx version 1.24.0-1 and, two seconds later, an added row for nginx version 1.26.0-1. Both lines use the query name packages, the same hostIdentifier, and the same package name. A draft says nginx was uninstalled at the removed line.
The note quotes both unixTime values, both actions, and both version columns. It says the package name stayed and the version column changed. It does not say the service was removed, and it does not treat the removed line by itself as the end of nginx on that host.
query: packages hostIdentifier: lab-db-01 unixTime 1793712000 action removed name=nginx version=1.24.0-1 unixTime 1793712002 action added name=nginx version=1.26.0-1
Diagram
Reading the action field
The line reports membership in the result, not a motive.
Means. This column set was not in the previous result
On the first run. Every current row, which is a baseline
Does not mean. Something unwanted started
Means. This column set was in the previous result and is not now
Often paired with. An added row whose stable columns match
Does not mean. A person uninstalled it, unless another row shows that
Check yourself
1. What does action removed mean?
2. The first run of a new scheduled query logs fifty added lines. What are they?
3. A package name is removed and the same name is added with a new version. What should the note say?