osquery::Status DBHandle::Delete(const std::string& domain, const std::string& key) { auto cfh = getHandleForColumnFamily(domain); if (cfh == nullptr) { return Status(1, "Could not get column family for " + domain); } auto s = getDB()->Delete(rocksdb::WriteOptions(), cfh, key); return Status(s.code(), s.ToString()); }
osquery::Status DBHandle::Get(const std::string& domain, const std::string& key, std::string& value) { auto cfh = getHandleForColumnFamily(domain); if (cfh == nullptr) { return Status(1, "Could not get column family for " + domain); } auto s = getDB()->Get(rocksdb::ReadOptions(), cfh, key, &value); return Status(s.code(), s.ToString()); }
osquery::Status DBHandle::Scan(const std::string& domain, std::vector<std::string>& results) { auto cfh = getHandleForColumnFamily(domain); if (cfh == nullptr) { return Status(1, "Could not get column family for " + domain); } auto it = getDB()->NewIterator(rocksdb::ReadOptions(), cfh); if (it == nullptr) { return Status(1, "Could not get iterator for " + domain); } for (it->SeekToFirst(); it->Valid(); it->Next()) { results.push_back(it->key().ToString()); } delete it; return Status(0, "OK"); }
Status DBHandle::Delete(const std::string& domain, const std::string& key) const { if (read_only_) { return Status(0, "Database in readonly mode"); } auto cfh = getHandleForColumnFamily(domain); if (cfh == nullptr) { return Status(1, "Could not get column family for " + domain); } auto options = rocksdb::WriteOptions(); // We could sync here, but large deletes will cause multi-syncs. // For example: event record expirations found in an expired index. // options.sync = true; auto s = getDB()->Delete(options, cfh, key); return Status(s.code(), s.ToString()); }
Status DBHandle::Put(const std::string& domain, const std::string& key, const std::string& value) const { if (read_only_) { return Status(0, "Database in readonly mode"); } auto cfh = getHandleForColumnFamily(domain); if (cfh == nullptr) { return Status(1, "Could not get column family for " + domain); } auto s = getDB()->Put(rocksdb::WriteOptions(), cfh, key, value); if (s.code() != 0 && s.IsIOError()) { // An error occurred, check if it is an IO error and remove the offending // specific filename or log name. std::string error_string = s.ToString(); size_t error_pos = error_string.find_last_of(":"); if (error_pos != std::string::npos) { return Status(s.code(), "IOError: " + error_string.substr(error_pos + 2)); } } return Status(s.code(), s.ToString()); }