osquery: the gap between lines is not the interval

The log shows when lines were written

Each differential line has a unixTime. The difference between two lines for the same schedule key on the same host is how far apart those lines were logged. It is a measurement from the log. It is not, by itself, the interval someone typed in the config.

A missing line is not a gap you can invent. If you only have one line, you do not have an interval from the log at all.

The interval is a config field

The schedule entry has an interval in seconds. That is what the daemon was told. It can differ from the gap you measure if a run was skipped, the host was off, or the config changed between the lines. Write the config value from the revision you believe was loaded, and write the measured gap from the two times.

Do not edit the log so the gap matches the config, and do not edit the note’s config number so it matches the gap. The difference is the fact.

What to file

File the schedule key, the host identifier, both unixTime values, the gap you computed, and the interval from the named config revision. If you do not have the config, write “interval not copied.” Do not claim the query runs every fifteen minutes from a gap of nine hundred seconds unless the config says 900.

Worked case: nine hundred seconds and a config of 3600

Two net_listeners lines for lab-web-02 are 900 seconds apart. The config revision from that week sets the interval to 3600. A draft changes the note to 3600 so the log “matches the standard.”

The note keeps the measured gap at 900 seconds and the configured interval at 3600, and says they differ. Nobody rewrites the log. The next question is why a line appeared early, which this pair of numbers does not answer by itself.

key: net_listeners  host: lab-web-02
unixTime: 1793628000 and 1793628900
measured gap: 900 seconds
config interval: 3600
write: they differ
not: change 900 to 3600 so the note looks standard