Explain how scheduled queries queue themselves up

[noahtalerman]

Goal

Explain how scheduled queries queue themselves up. See the "Notes" section below for more context.

How?

• Maybe add a link to relevant section of osquery docs
• Maybe bring osquery explanation into Fleet docs

Notes

This came out of the following conversation on Slack (internal):

Customer: Do scheduled queries queue themselves up if the device is powered off or sleeping? e.g., if a scheduled query misses its X hour time, and the device is powered on an hour after the schedule, does it run it immediately, or does it wait for the next scheduled time?

@roperzh: Hey! I think this quote from the osquery docs might answer your question better than I could:

NOTICE: that the interval time in seconds is how many seconds the daemon itself has been running before the scheduled query will be executed. If the system is suspended or put to sleep the progression of time "freezes" and resumes when the system comes back online. For example a scheduled query with an interval of 86400, or 24 hours, running on a laptop system could take a few days before the query executes if the system is suspended at night.
Source: https://osquery.readthedocs.io/en/stable/deployment/configuration/

Customer: Thank you, I was looking through Fleet documentation, didn't think to go check osquery docs.

[noahtalerman]

@roperzh heads up, this is the issue tracking your request. This request was discussed during product office hours on 2022-08-18.

This request is not prioritized. I filed the issue to track the request so that we can come back to it.