we made some cfg in our osquery.flags to add limit...
# generalw
wennan.he
03/21/2024, 1:15 AMwe made some cfg in our osquery.flags to add limit to cpu as shown below
# watch dog
--disable_watchdog=false
--watchdog_level=0
--watchdog_memory_limit=300
--watchdog_delay=60
--watchdog_utilization_limit=0
--watchdog_max_delay=600
--enable_extensions_watchdog=true
--watchdog_forced_shutdown_delay=4
--watchdog_latency_limit=0
And --watchdog_utilization_limit=0
This configuration should prevent osquery from occupying more than 10% of the CPU.
but after we tried running the performance tools kit of osquery, we discovered osquery actually might occupy more than 10% as report shown below
by watching the outcome of top we actually caught some cases osqueryd occupied over 100% of cpu even it is just a short period. could any help to explain why? and offer how to config watchdog correctly to restrict the cpu usage of osquery.
wennan.he
03/21/2024, 2:02 AMi looks like the reason is osqueryi is different from osqueryd, but we want to know that is there any ways to run the performance tool kits with osqueryd not osqueryi?
wennan.he
03/21/2024, 2:04 AMone more question, our cfg can restrict CPU keep running lower than 20% from our monitoring, but it doesn't match to what doc saying. is there any way we can reduce this limit val still?