https://github.com/osquery/osquery logo
Join Slack
Powered by
This message was deleted.
# fleet
s
This message was deleted.
b
It seems like the database might be overloaded. Any metrics coming from MySQL that can confirm or deny? Roughly how many hosts deployed and what’s the rough size of the database?
j
We have 2351 total hosts, but not all of them are online/active. The fleetdm instance size is 
db.t4g.medium
b
T class run on burstable vCPU credits. It’s possible this size might not be adequate. How’s cpu utilization looking? Number of connections?
j
it currently says 14.65% CPU
Hey @Benjamin Edwards - do you have any other areas I should be checking? I only see some action in the 
AbortedClients
chart.
b
How many connections? T class also have low thresholds on max concurrent connections.
j
Screen Shot 2024-02-01 at 10.26.27 AM.png
For some odd reason, the OSQuery version started to update to the latest version on the hosts; from 
5.9.1
to 
5.11.0
Not sure what changed, but I didn't touch the infra. 😅
b
fleetd auto updates osquery.
j
via orbit right? the version was stuck at 5.9.1 for awhile until today. before i was getting this error when running the orbit_info query, 
2024-01-27T04:24:38Z: POST /api/fleet/orbit/config received status 502 unknown
, and the error hasn't appeared today.
b
I wonder if the setting we modified has corrected some issues?
j
Possibly, what setting was modified? just curious.
b
We disabled query reporting right?
j
Oh right, yes sorry! I was confused from our email thread vs this one hahaha
b
Side note, are you seeing logs arrive yet?
j
I'm still not - I checked recently and even updated the frequency to 30 min.
Can we set up another call for next week to take another look?
b
In the meantime, I’d suggest upgrading to the latest.
j
Hey @Benjamin Edwards - we just upgraded to the latest version 4.43.3
Open in Slack
PreviousNext
Powered by