Hi all, i have a strange issue with my fleetserver on RHEL 9, maybe someone has seen it before. First of all: The Server works, i have 160 Clients enrolled, they provide data and i can run queries against them. I noticed root is running low on space. This is because the MySQL server continuously writes large binlogfiles until the partition is full. I started investigating further and noticed that the fleet is consuming 100% CPU all the time. I assume the root cause is this error message: Nov 6 084612 de-fleetdm01 fleet[13182]: {"component":"http","err":"authentication error: invalid node key: Uhpesjv3RwK6DXOA21viOZ3MPhHYuYTj","level":"info","path":"/api/v1/osquery/distributed/read","ts":"2023-11-06T074612.989505767Z","uuid":"a85b4b4c-4bc2-411d-9d10-cd1491a4b553"} The error occurs every second for all 160 Clients. Again, everything is workign fine, thats why i did not notice it in the first place. I read a post here that someone fixed the problem, by changing the host_identifier to "hostname". That didn´t work and now i´m running out of ideas 🙂

yeah I had to reduce the retention period of mysql bin logs, you could also expand your disk if you want to keep those, but most things that are important are fairly static To do so I have

binlog_expire_logs_seconds=864000

in /etc/my.cnf.d/mysql-server.cnf

Hey @Keith Swagler, thank you for the reply. I also reduced the retention to 3 days and extended the root partition. (Yes i know, databases should not be on root. 😉 ) But the high cpu and disk usage drives me crazy. Today i deleted all clients from the server and stopped the enrollment process. The error and 100% cpu usage is the same, even without any Client connected. I think its time to start over from the scratch ...