Skip to content

Commit

Permalink
Ship "Executing scheduled query pack" logs (#2081)
Browse files Browse the repository at this point in the history
  • Loading branch information
RebeccaMahany authored Jan 31, 2025
1 parent fb30e62 commit 77c3156
Showing 1 changed file with 1 addition and 8 deletions.
9 changes: 1 addition & 8 deletions ee/log/osquerylogs/log.go
Original file line number Diff line number Diff line change
Expand Up @@ -59,13 +59,6 @@ func NewOsqueryLogAdapter(slogger *slog.Logger, rootDirectory string, opts ...Op
}

func (l *OsqueryLogAdapter) Write(p []byte) (int, error) {
// Work around osquery being overly verbose with it's logs
// see: https://github.com/osquery/osquery/pull/6271
level := l.level
if bytes.Contains(p, []byte("Executing scheduled query pack")) {
level = slog.LevelDebug
}

if bytes.Contains(p, []byte("Accelerating distributed query checkins")) {
// Skip writing this. But we still return len(p) so the caller thinks it was written
return len(p), nil
Expand Down Expand Up @@ -105,7 +98,7 @@ func (l *OsqueryLogAdapter) Write(p []byte) (int, error) {

msg := strings.TrimSpace(string(p))
caller := extractOsqueryCaller(msg)
l.slogger.Log(context.TODO(), level, // nolint:sloglint // it's fine to not have a constant or literal here
l.slogger.Log(context.TODO(), l.level, // nolint:sloglint // it's fine to not have a constant or literal here
msg,
"caller", caller,
)
Expand Down

0 comments on commit 77c3156

Please sign in to comment.