Running Containers and Container Lifespan

Using Capsule8's container events it is possible to query which containers have spun up, whether they are alive, and if not how long they were alive. The query will return the most recent container events in descending order. 

Required Tables

• container_events

Input Fields

The query can limit how many results are shown by replacing the default value of 10 in the query.

Returned Fields

Query

SELECT image_name,
         FROM_UNIXTIME(container_events.unix_nano_timestamp/1e9) AS started,
         (exit_event.unix_nano_timestamp-container_events.unix_nano_timestamp)/1e9 AS duration
FROM container_events
LEFT OUTER JOIN 
    (SELECT unix_nano_timestamp, container_id
    FROM container_events
    WHERE event_type=3) AS exit_event
    ON container_events.container_id = exit_event.container_id
WHERE event_type = 2 AND (exit_event.unix_nano_timestamp > container_events.unix_nano_timestamp OR exit_event.unix_nano_timestamp IS NULL)
ORDER BY container_events.unix_nano_timestamp DESC LIMIT 10