https://github.com/osquery/osquery logo
Join Slack
Powered by
anyone could help?
# fleet
w
anyone could help?
d
Here the agent is told every 10s check for queries from Fleet. Every 10s send logs. Every 1minute check for any config updates.
w
can i say there is http connection between agent and fleet?
k
I'm not quite sure what you're asking there, @wennan.he. Can you clarify a little for me?
w
@Kathy Satterlee what i mean should i see a http access from each host install agent to fleet every 10 s?
k
Thanks! Yes, with those settings, every host would check for queries to run and send any logs every 10 seconds and check for configuration updates every 60 seconds.
w
that is weird, our fleet already been running over 6 months, but we never seen that huge connections before recently.
and do you know is there anyway i can check the change history of this value? also, i checked the doc, it looks like either agent side or server side can change the value of distributed_interval, right?
k
Pulling up some docs for you 🙂
It's definitely interesting that this is new behavior though. Have y'all updated Fleet or changed configuration recently?
w
hold on. new behavior? what does it mean, it didn't exist for earlier version of fleet?
yes, we did upgrade fleet recently
so could u tell me distributed_interval comes out with which version of fleet?
k
I meant that you haven't seen this on your server before.
w
i didn't notice that. that is what i mean.
k
Here are the options you'll want to set in agent options: it's a bit of a balancing act between limiting requests and making live queries useful
Copy code
distributed_interval=10
logger_tls_period=3
config_refresh=3600
w
so it is only configureable at agent side?
k
They are agent settings, but you can also set them in 
agent_options.options
on the Fleet side. https://fleetdm.com/docs/using-fleet/fleet-ui#update-agent-options
2 Views
Open in Slack
PreviousNext
Powered by