Title
#fleet
ytonui

ytonui

02/10/2022, 4:02 PM
Hi, any idea what would cause a context to be cancelled? Here's a sample error that's seen:
{
  "component": "http",
  "err": "timestamp: 2022-02-10T15:42:49Z: error in query ingestion || timestamp: 2022-02-10T15:42:49Z: error in query ingestion || timestamp: 2022-02-10T15:42:49Z: error in query ingestion || getting app config: selecting app config: timestamp: 2022-02-10T15:42:49Z: context canceled",
  "ingestion-err": "ingest detail query: selecting app config: timestamp: 2022-02-10T15:42:49Z: context canceled",
  "ip_addr": "10.16.14.145:57498",
  "level": "error",
  "method": "POST",
  "took": "14.669590338s",
  "ts": "2022-02-10T15:42:49.244372692Z",
  "uri": "/api/v1/osquery/distributed/write",
  "x_for_ip_addr": "10.23.14.12"
}
Tomas Touceda

Tomas Touceda

02/10/2022, 4:21 PM
hi there, that usually means that the connection to the database timed out. Are you seeing this error often?
ytonui

ytonui

02/10/2022, 5:16 PM
Yes, seeing this whenever we enrol a device.. I was thinking its something to do with memory since the list of applications from some devices is huge
Tomas Touceda

Tomas Touceda

02/10/2022, 5:22 PM
the memory of the fleet instance? could you tell me a bit more about your infrastructure? sizes of the fleet instances, size of the db, redis, amount of hosts
ytonui

ytonui

02/10/2022, 6:11 PM
Fleet instance: 4.2Ghz 16Gb RAM Size of the db: 4.2Ghz 16Gb RAM, 1 TB Redis: running on the fleet instance amount of hosts: so far just 2 for testing
6:11 PM
thanks for the pointer.. I'll check the db for any clues