Here the agent is told every 10s check for queries from Fleet. Every 10s send logs. Every 1minute check for any config updates.
09/16/2022, 3:42 AM
can i say there is http connection between agent and fleet?
09/16/2022, 5:32 PM
I'm not quite sure what you're asking there, @wennan.he. Can you clarify a little for me?
09/16/2022, 8:16 PM
@Kathy Satterlee what i mean should i see a http access from each host install agent to fleet every 10 s?
09/16/2022, 8:41 PM
Thanks! Yes, with those settings, every host would check for queries to run and send any logs every 10 seconds and check for configuration updates every 60 seconds.
09/16/2022, 8:44 PM
that is weird, our fleet already been running over 6 months, but we never seen that huge connections before recently.
and do you know is there anyway i can check the change history of this value? also, i checked the doc, it looks like either agent side or server side can change the value of distributed_interval, right?
09/16/2022, 8:50 PM
Pulling up some docs for you 🙂
It's definitely interesting that this is new behavior though. Have y'all updated Fleet or changed configuration recently?
09/16/2022, 8:51 PM
hold on. new behavior? what does it mean, it didn't exist for earlier version of fleet?
yes, we did upgrade fleet recently
so could u tell me distributed_interval comes out with which version of fleet?
09/16/2022, 8:54 PM
I meant that you haven't seen this on your server before.
09/16/2022, 8:57 PM
i didn't notice that. that is what i mean.
09/16/2022, 9:04 PM
Here are the options you'll want to set in agent options: it's a bit of a balancing act between limiting requests and making live queries useful