Looking forward to seeing how difficult it would be to integrate this into a different fleet mgt tool

Playing with the code, it seems hard to use as a library? So if I want to use it against some internal server, I need to make a hard fork. At least, trying to use a bunch of the integration seems hard since it’s based on a global

api

object, and not something that’s passed around.

Congrats on the release y'all!

abd what about to have this without a fleet manager? I mean osquery deployed on thousand machines and using goquery to run live query, is it scalable?

Hey everyone, first post in a while. Does anyone know where to configure the "accelerated mode" mentioned in the osquery@scale talk? Or is it just a matter of turning down the checkin times in the config ?

https://github.com/osquery/osquery/blob/c5b8bfa9acc627a5dfef83cb96ed1f47e342dd5a/osquery/distributed/distributed.cpp#L238-L252 https://github.com/osquery/osquery/blob/c5b8bfa9acc627a5dfef83cb96ed1f47e342dd5a/osquery/dispatcher/distributed_runner.cpp#L39-L50 If the distributed read response json includes an

accelerate

key, the value (in seconds) is how long to go into accelerated mode for. While in accelerated mode, this is polled every 5s. (cc @Keith Swagler)

thanks for that calrification @seph !

I happen to know where in the code that lives. Documentation PRs are always welcome 🙂