---
apiVersion: v1
kind: pack
spec:
  name: performance-metrics
  queries:
  - description: Records the CPU time and memory usage for each individual query.
      Helpful for identifying queries that may impact performance.
    interval: 1800
    name: per_query_perf
    query: per_query_perf
    snapshot: true
  - description: Track the amount of CPU time used by osquery.
    interval: 1800
    name: runtime_perf
    query: runtime_perf
    snapshot: true
  - description: Track the percentage of total CPU time utilized by $endpoint_security_tool
    interval: 1800
    name: endpoint_security_tool_perf
    query: endpoint_security_tool_perf
    snapshot: true
  - description: Track the percentage of total CPU time utilized by $backup_tool
    interval: 1800
    name: backup_tool_perf
    query: backup_tool_perf
    snapshot: true
  targets:
    labels: 
    - MS Windows
    - macOS
---
apiVersion: v1
kind: query
spec:
  description: Records the CPU time and memory usage for each individual query. Helpful
    for identifying queries that may impact performance.
  name: per_query_perf
  query: SELECT name, interval, executions, output_size, wall_time, (user_time/executions)
    AS avg_user_time, (system_time/executions) AS avg_system_time, average_memory
    FROM osquery_schedule;
---
apiVersion: v1
kind: query
spec:
  description: Track the amount of CPU time used by osquery.
  name: runtime_perf
  query: SELECT ov.version AS os_version, ov.platform AS os_platform, ov.codename
    AS os_codename, i.*, p.resident_size, p.user_time, p.system_time, time.minutes
    AS counter, db.db_size_mb AS database_size FROM osquery_info i, os_version ov,
    processes p, time, (SELECT (sum(size) / 1024) / 1024.0 AS db_size_mb FROM (SELECT
    value FROM osquery_flags WHERE name = 'database_path' LIMIT 1) flags, file WHERE
    path LIKE flags.value || '%%' AND type = 'regular') db WHERE p.pid = i.pid;
---
apiVersion: v1
kind: query
spec:
  description: Track the percentage of total CPU time utilized by $endpoint_security_tool
  name: endpoint_security_tool_perf
  query: SELECT ((tool_time*100)/(SUM(system_time) + SUM(user_time))) AS pct FROM
    processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time)) AS tool_time
    FROM processes WHERE name='endpoint_security_tool');
---
apiVersion: v1
kind: query
spec:
  description: Track the percentage of total CPU time utilized by $backup_tool
  name: backup_tool_perf
  query: SELECT ((backuptool_time*100)/(SUM(system_time) + SUM(user_time))) AS pct
    FROM processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time))
    AS backuptool_time FROM processes WHERE name='backup_tool');
