Hello.. I have osquery installed on 50 servers and connected to Fleet. For scaling, i was asked how the communication flow between the agent and the Fleet server happens. Does the Fleet server initiate the call to the agent which 'wakes up' the agent. or Does the agent sent the server information to Fleet server periodically and when we create and execute a query, the Fleet 'reads' the data from the database. This is required to understand the f/w and port rules to be set up to enable the implementation

All communication is initiated by the agent.

Thanks Kathy Is this documented in the Fleet docs. If so, kindly share the link. I can share it with my SME

Once the queries are run, osquery sends back results.

sorry, could you give me more details. if the query is run from Fleet..Fleet triggers the communication to osquery..osq finds the data and replies back - is this correctly understood? the team are bit apprehensive if Fleet starts the communication..as it would mean that every agent must have an exposed http listener, accessible from the Fleet server. i.e. every VM must be running a 443 listener (or maybe a custom port) But if the agent keeps updating Fleet then it is not an issue

No, Fleet does not start communication. The flow is a bit like this:

thanks..and is it the same when we are running a API call, specifically GET /api/v1/fleet/hosts

That wouldn't require any communication with the agent in the moment, it's grabbing the host information stored in the Fleet database. Behind the scenes, that's gathered using live queries sent at a preset interval that follow the flow above.

Thank you Kathy for your support. Much appreciated Considering the attached screenshot, where i ran a random query - SELECT * FROM cpu_info. Can you help me understand what does it mean when it says 21% responded.. also, going back to the flow you mentioned, when i click 'Run Query' in the Fleet UI, does it fall under the step 2

That means that of the 68 hosts that were targeted, 21% have sent results.

Thank you..where do i check the interval set for the hosts to check in to the Fleet server

That is based on the distributed interval set in agent options or as an osquery flag.

Thanks again Kathy..will come back if i get asked more questions. 🤝🙂