J
02/03/2022, 7:52 AMStefano Bonicatti
02/03/2022, 9:01 AM--alarm_timeout=10
. Unfortunately you can’t get lower than that; I’ll make a fix which should land in 5.2.2.J
02/03/2022, 9:38 AMStefano Bonicatti
02/03/2022, 11:22 AMJ
02/03/2022, 12:32 PMStefano Bonicatti
02/03/2022, 12:38 PMJ
02/03/2022, 12:38 PMHans
02/03/2022, 12:38 PMStefano Bonicatti
02/03/2022, 12:43 PMalarm_delay
comes from but alarm_timeout
can be brought down from 15 seconds to 10 seconds via --alarm_timeout=10
. This means that due to some internal calculations osquery will wait 6 seconds instead of 11 to do a SIGKILL.
alarm_timeout
is really meant to control the clean shutdown logic and provide a deadline to that, unfortunately it is currently tied also to the resource limit kill. But with the PR above I changed so that osquery kills the process as soon as the watchdog notices the limit being hit.Hans
02/03/2022, 12:43 PMStefano Bonicatti
02/03/2022, 12:54 PMHans
02/03/2022, 12:55 PMStefano Bonicatti
02/03/2022, 12:56 PMHans
02/03/2022, 1:01 PM