Hi team! I am using Fleet with MySQL master+slave schema and logger_plugin: tls. Agents send logs to fleet server and fleet save that logs to file osquery_result. Today I found that if MySQL master is UP and MySQL slave instance is DOWN my agents can't send logs to fleet and there are no logs in file osquery_result. But if MySQL master is DOWN and MySQL slave is UP all logs is get correctly. Can you explane me that behavior? Why do orbit agents need MySQL to send logs if the logs are not written to the MySQL database? Fleet: Fleet 4.35.1 • Go go1.20.1 Orbit: orbit 1.13.0

Hi, @Lili. All incoming requests from agents are authenticated using a node key, which is stored in the MySql Database.

@Kathy Satterlee Do you planning work with MySQL Percona Cluster or add support of using PosgreSQL for high availability using DB? If MySQL node is failed, we lose a logs from agents.

We don’t have any active plans to support MySql Cluster, but we do support using a read replica. osquery is fairly resilient to outages and will buffer logs by default if an error is returned.

@Kathy Satterlee ok, thank you