{"action":"created","comment":{"url":"https://api.github.com/repos/facebook/osquery/pulls/comments/44696350","id":44696350,"diff_hunk":"@@ -309,38 +310,130 @@ typedef struct Constraint Constraint;\n  */\n class TablePlugin : public Plugin {\n  protected:\n-  virtual TableColumns columns() const {\n-    TableColumns columns;\n-    return columns;\n-  }\n+  /// Return the table's column name and type pairs.\n+  virtual TableColumns columns() const { return TableColumns(); }\n \n-  virtual QueryData generate(QueryContext& request) {\n-    QueryData data;\n-    return data;\n-  }\n+  /**\n+   * @brief Generate a complete table representation.\n+   *\n+   * The TablePlugin::generate method is the most important part of the table.\n+   * This should return a best-effort match of the expected results for a\n+   * query. In common cases, this returns all rows for a virtual table.\n+   * For EventSubscriber tables this will perform database lookups for events\n+   * matching several conditions such as time within the SQL query or the last\n+   * time the EventSubscriber was called.\n+   *\n+   * The context input is filled in \"as best possible\" by SQLite's\n+   * virtual table APIs. In the best case this context include a limit or\n+   * constraints organized by each possible column.\n+   *\n+   * @param request A query context filled in by SQLite's virtual table API.\n+   * @return The result rows for this table, given the query context.\n+   */\n+  virtual QueryData generate(QueryContext& request) { return QueryData(); }\n \n  protected:\n+  /// An SQL stable containing the table definition/syntax.\n   std::string columnDefinition() const;\n+\n+  /// Return the name and column pairs for attaching virtual tables.\n   PluginResponse routeInfo() const;\n \n+  /**\n+   * @brief Check if there are fresh cache results for this table.\n+   *\n+   * Table results are considered fresh when evaluated against a given interval.\n+   * The interval is the expected rate for which this data should be generated.\n+   * Caching and cache freshness only applies to queries acting on tables\n+   * within a schedule. If two queries \"one\" and \"two\" both inspect the\n+   * table \"processes\" at the interval 60. The first executed will cache results\n+   * and the second will use the cached results.\n+   *\n+   * Table results are not cached is a QueryContext contains constraints or","path":"include/osquery/tables.h","position":114,"original_position":114,"commit_id":"a48a129524c41fcf6df6cec2d4b8d5be98685a60","original_commit_id":"a48a129524c41fcf6df6cec2d4b8d5be98685a60","user":{"login":"sharvilshah","id":819943,"avatar_url":"https://avatars.githubusercontent.com/u/819943?v=3","gravatar_id":"","url":"https://api.github.com/users/sharvilshah","html_url":"https://github.com/sharvilshah","followers_url":"https://api.github.com/users/sharvilshah/followers","following_url":"https://api.github.com/users/sharvilshah/following{/other_user}","gists_url":"https://api.github.com/users/sharvilshah/gists{/gist_id}","starred_url":"https://api.github.com/users/sharvilshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharvilshah/subscriptions","organizations_url":"https://api.github.com/users/sharvilshah/orgs","repos_url":"https://api.github.com/users/sharvilshah/repos","events_url":"https://api.github.com/users/sharvilshah/events{/privacy}","received_events_url":"https://api.github.com/users/sharvilshah/received_events","type":"User","site_admin":false},"body":"nit: if a QueryContext contains...","created_at":"2015-11-12T18:41:35Z","updated_at":"2015-11-12T18:41:35Z","html_url":"https://github.com/facebook/osquery/pull/1639#discussion_r44696350","pull_request_url":"https://api.github.com/repos/facebook/osquery/pulls/1639","_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments/44696350"},"html":{"href":"https://github.com/facebook/osquery/pull/1639#discussion_r44696350"},"pull_request":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1639"}}},"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1639","id":50085409,"html_url":"https://github.com/facebook/osquery/pull/1639","diff_url":"https://github.com/facebook/osquery/pull/1639.diff","patch_url":"https://github.com/facebook/osquery/pull/1639.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1639","number":1639,"state":"open","locked":false,"title":"Table results caching","user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"body":"1. Table implementations (spec files) can mark the table as 'cachable'.\r\n2. Cached results depend on the shortest/quickest interval of scheduled queries that act on results of the table.\r\n3. The table API generator blocks caching on index/additional/required table column options.","created_at":"2015-11-09T05:06:47Z","updated_at":"2015-11-12T18:41:35Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9d5aaf35d487b44b833d229fe05238d89f78f24d","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/1639/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/1639/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1639/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/a48a129524c41fcf6df6cec2d4b8d5be98685a60","head":{"label":"theopolis:cache","ref":"cache","sha":"a48a129524c41fcf6df6cec2d4b8d5be98685a60","user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"repo":{"id":26103098,"name":"osquery","full_name":"theopolis/osquery","owner":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/theopolis/osquery","description":"SQL powered operating system instrumentation and monitoring.","fork":true,"url":"https://api.github.com/repos/theopolis/osquery","forks_url":"https://api.github.com/repos/theopolis/osquery/forks","keys_url":"https://api.github.com/repos/theopolis/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/theopolis/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/theopolis/osquery/teams","hooks_url":"https://api.github.com/repos/theopolis/osquery/hooks","issue_events_url":"https://api.github.com/repos/theopolis/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/theopolis/osquery/events","assignees_url":"https://api.github.com/repos/theopolis/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/theopolis/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/theopolis/osquery/tags","blobs_url":"https://api.github.com/repos/theopolis/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/theopolis/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/theopolis/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/theopolis/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/theopolis/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/theopolis/osquery/languages","stargazers_url":"https://api.github.com/repos/theopolis/osquery/stargazers","contributors_url":"https://api.github.com/repos/theopolis/osquery/contributors","subscribers_url":"https://api.github.com/repos/theopolis/osquery/subscribers","subscription_url":"https://api.github.com/repos/theopolis/osquery/subscription","commits_url":"https://api.github.com/repos/theopolis/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/theopolis/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/theopolis/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/theopolis/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/theopolis/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/theopolis/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/theopolis/osquery/merges","archive_url":"https://api.github.com/repos/theopolis/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/theopolis/osquery/downloads","issues_url":"https://api.github.com/repos/theopolis/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/theopolis/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/theopolis/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/theopolis/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/theopolis/osquery/labels{/name}","releases_url":"https://api.github.com/repos/theopolis/osquery/releases{/id}","created_at":"2014-11-03T03:56:14Z","updated_at":"2015-04-26T10:54:32Z","pushed_at":"2015-11-10T09:01:27Z","git_url":"git://github.com/theopolis/osquery.git","ssh_url":"git@github.com:theopolis/osquery.git","clone_url":"https://github.com/theopolis/osquery.git","svn_url":"https://github.com/theopolis/osquery","homepage":"http://osquery.io","size":8911,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"988daeb9e6a1492be161bc058c46275fcefcedcd","user":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","created_at":"2014-07-29T20:27:33Z","updated_at":"2015-11-12T17:00:47Z","pushed_at":"2015-11-11T22:18:48Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":16501,"stargazers_count":5387,"watchers_count":5387,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":506,"mirror_url":null,"open_issues_count":24,"forks":506,"open_issues":24,"watchers":5387,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1639"},"html":{"href":"https://github.com/facebook/osquery/pull/1639"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/1639"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/1639/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1639/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1639/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/a48a129524c41fcf6df6cec2d4b8d5be98685a60"}}}}