Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
w
wennan.he
09/16/2022, 3:29 AManyone could help?
d
Daniel Cross
09/16/2022, 3:33 AMHere the agent is told every 10s check for queries from Fleet. Every 10s send logs. Every 1minute check for any config updates.
w
wennan.he
09/16/2022, 3:42 AMcan i say there is http connection between agent and fleet?
k
Kathy Satterlee
09/16/2022, 5:32 PMI'm not quite sure what you're asking there, @wennan.he. Can you clarify a little for me?
w
wennan.he
09/16/2022, 8:16 PM@Kathy Satterlee what i mean should i see a http access from each host install agent to fleet every 10 s?
k
Kathy Satterlee
09/16/2022, 8:41 PMThanks! Yes, with those settings, every host would check for queries to run and send any logs every 10 seconds and check for configuration updates every 60 seconds.
w
wennan.he
09/16/2022, 8:44 PMthat is weird, our fleet already been running over 6 months, but we never seen that huge connections before recently.
and do you know is there anyway i can check the change history of this value? also, i checked the doc, it looks like either agent side or server side can change the value of distributed_interval, right?
k
Kathy Satterlee
09/16/2022, 8:50 PMPulling up some docs for you 🙂
It's definitely interesting that this is new behavior though. Have y'all updated Fleet or changed configuration recently?
w
wennan.he
09/16/2022, 8:51 PMhold on. new behavior? what does it mean, it didn't exist for earlier version of fleet?
yes, we did upgrade fleet recently
so could u tell me distributed_interval comes out with which version of fleet?
k
Kathy Satterlee
09/16/2022, 8:54 PMI meant that you haven't seen this on your server before.
w
wennan.he
09/16/2022, 8:57 PMi didn't notice that. that is what i mean.
k
Kathy Satterlee
09/16/2022, 9:04 PMHere are the options you'll want to set in agent options: it's a bit of a balancing act between limiting requests and making live queries useful
distributed_interval=10
logger_tls_period=3
config_refresh=3600w
wennan.he
09/16/2022, 9:23 PMso it is only configureable at agent side?
k
Kathy Satterlee
09/16/2022, 10:55 PMThey are agent settings, but you can also set them in
agent_options.options