Artem
02/07/2022, 5:21 PMW0207 18:02:24.934172 4352 watcher.cpp:391] osqueryd worker (560) stopping: Maximum sustainable CPU utilization limit exceeded: 18
close after executing fleet_detail_query_software_windows
• Adding --disable_watchdog=false --watchdog_delay=120 --watchdog_level=0 --watchdog_memory_limit=400 --watchdog_utilization_limit=21
was with no luck;
And now I have no thoughts..zwass
Artem
02/08/2022, 9:41 AMTomas Touceda
02/08/2022, 11:48 AM---
apiVersion: v1
kind: config
spec:
host_settings:
enable_software_inventory: false
if you apply that yaml, fleet will stop sending the software inventory queries to the hostsArtem
02/08/2022, 12:33 PMTomas Touceda
02/08/2022, 1:08 PMArtem
02/08/2022, 6:38 PMTomas Touceda
02/08/2022, 6:40 PMArtem
02/09/2022, 11:35 AMenable_host_users = false
as that query returns about 1800 domain users, but it looks like that the issue only with enable_software_inventory
Tomas Touceda
02/09/2022, 11:38 AMWITH cached_users AS (SELECT * FROM users)
SELECT
name AS name,
version AS version,
'Program (Windows)' AS type,
'programs' AS source
FROM programs
UNION
SELECT
name AS name,
version AS version,
'Package (Python)' AS type,
'python_packages' AS source
FROM python_packages
UNION
SELECT
name AS name,
version AS version,
'Browser plugin (IE)' AS type,
'ie_extensions' AS source
FROM ie_extensions
UNION
SELECT
name AS name,
version AS version,
'Browser plugin (Chrome)' AS type,
'chrome_extensions' AS source
FROM cached_users CROSS JOIN chrome_extensions USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Browser plugin (Firefox)' AS type,
'firefox_addons' AS source
FROM cached_users CROSS JOIN firefox_addons USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Package (Chocolatey)' AS type,
'chocolatey_packages' AS source
FROM chocolatey_packages
UNION
SELECT
name AS name,
version AS version,
'Package (Atom)' AS type,
'atom_packages' AS source
FROM cached_users CROSS JOIN atom_packages USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Package (Python)' AS type,
'python_packages' AS source
FROM python_packages;
to see if that's taking too long on its own?Artem
02/09/2022, 1:01 PMSELECT * FROM users
which returns ~3500 results (domain users + domain computers) and it increases CPU usage.
I think this SELECT should be as in users query.Tomas Touceda
02/09/2022, 1:23 PMzwass
select * from users
on that DC, do all of the users have a value for the directory
column?Artem
02/09/2022, 5:08 PMdirectory
field exists only for accounts with successful local login.
I attached redacted results with filled directory
, all domain users looks like as in the last two lines.Tomas Touceda
02/17/2022, 1:17 PMGregory Storme
03/17/2022, 12:59 PMenable_software_inventory: false
defensivedepth
03/17/2022, 5:37 PM