Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi folks! I have a question around the watchdog and CPU physical vs virtual cores.

The watcher uses the number of CPUs to calculate the CPU utilization limit, see <https://github.com/osquery/osquery/blob/2e3495837d4fe4db3554c6ef76494bc86c74c099/osquery/core/watcher.cpp#L474-L480|here>.

What's the reason behind using real instead of virtual cores? See <https://github.com/osquery/osquery/blob/2e3495837d4fe4db3554c6ef76494bc86c74c099/osquery/core/watcher.cpp#L61|here> and <https://www.boost.org/doc/libs/1_58_0/doc/html/thread/thread_management.html#thread.thread_management.thread.physical_concurrency|here>.

E.g. my macOS has 4 physical cores but my OS sees 8 cores (e.g. htop shows 8 cores). Osquery is using 4 instead of 8 for the above calculation of limits. Shouldn't it be using 8?

This looks like it comes from <https://github.com/osquery/osquery/pull/4431>

I’m not sure there’s clear reason in that PR. I would naively guess it’s not well reasoned. It might also be old enough that virtual cores weren’t very good

Oh thanks, that makes sense.

I documented this real vs virtual thing here: <https://github.com/osquery/osquery/pull/8070/files>

Yeah that really seems a bug at this point and something we should change ^^'.
Maybe it's worth checking if there's any specific issue with the method that virtual cores are counted under various hypervisors, but I think it's years that everyone always considered the limit to be on the whole CPU.

For reference: <https://github.com/osquery/osquery/pull/8104>