i think i have an easy one today... finally got my first denylisted query on a host... so denylisted = 1... after 24 hours will that turn back to 0 on its own or is there a way to force that "bit" to reset back to 0?

Hi @mason kemmerer! I haven't found a method of manually removing a query from the denylist, it will roll back to 0 once it expires.

2 questions... are there any fleet documented ways to measure or potentially warn admins that a query is non-performant BEFORE the watchdog service denylists it? I love the Performance Impact column in the fleet webgui but wish it had a better mathematic explanation as what defines the thresholds: minimal, considerable, excessive I wish there was to eval this in live queries before they go live (scheduled) to all hosts Since starting this fleet-osquery endeavor I have had this query running every 5 minutes:

SELECT name, query, interval, executions, last_executed, denylisted, output_size,
  IFNULL(system_time / executions, 0) AS avg_sys_time,
  IFNULL(user_time / executions, 0) AS avg_usr_time,
  IFNULL(wall_time / executions, 0) AS avg_wall_time,
ROUND((average_memory * '10e-7'), 2) AS avg_mem_mb 
FROM osquery_schedule;

When reviewing the results of the above query in splunk it seemed the logs were showing that the denylisted query's avg sys, usr, and wall times and memory usage were zero leading up to the query being denylisted on the host. which was a huge bummer. FWIW, i have the watchdog service set to default settings (200M or 10% cpu for 12 secs) which also makes me wonder if theres something i misunderstood... is that 10% of the total CPU on the system, available at query execution time, or even a single core? Just trying to make sense where my miss was so I can adjust my osquery and splunk dashboard accordingly

The challenge there is that a query being deny-listed doesn't necessarily mean that it was non-performant.

All of that is super helpful (i didnt know that things outside of osquery could cause in the trigger of the watchdog) and thanks for explaining the impact definitions. Ah allowing live queries to determine performance before scheduling with all hosts!?! 🤌

It isn't that things outside of osquery might trigger the watchdog, it's just that this particular query might not be the thing that did.

ah so would you say its more the culmination of all the queries running on the host, and the watchdog just happened to pick this query to denylist?

Totally valid questions.

ah i guess in this particular case just that 1 query from what i saw was denylisted

That's the most likely scenario, but it could also be something else that was happening in the background. It's interesting that the user time and system time were zero before the query was denylisted. What's the actual query?

it was....

select * from process_memory_map;

Daily frequency