scheduled queries on boot/startup

Feature request

What new feature do you want?

I would like to be able to configure a query schedule that will run queries on boot or shortly thereafter and then follow an existing query schedule.

How is this new feature useful?

In a cloud environment where some instances are short-lived, it would be great to always have snapshot query results or a first differential query for every instance, even those that only live for a short time (e.g., minutes to an hour). Currently, one would need to set the interval for differential queries to be quite small (e.g., 10 minutes) to catch most short lived instances. Even then, there is no guarantee. But by doing so, you make it so that additional on-host resources are consumed more regularly to run queries that don't effectively need to be run so often. This is especially true for more costly (in terms of CPU/memory) tables or custom extensions.

How can this be implemented?

I imagine an additional option like run_on_boot that would execute the query as soon as osquery first starts on boot (but still subject to the splay interval if configured). It would then follow the interval specified for any further queries.

    "memory-info": {
      "query": "SELECT * FROM memory_info ;",
      "interval": "43200",
      "run_on_boot": "true",
    },

because of how I want to use this, I would want this to happen on every system boot. But other folks might want to control whether this happens every time osqueryd starts.

No implementation files, tests, or entry points are named in the issue. Start by locating osquery’s existing query-schedule configuration and startup path, then compare how interval and splay settings are handled. Done means a configured query runs on startup and then follows its existing interval schedule.