Title
#general
b

Benjamin Whetstone

01/24/2022, 10:05 PM
If I am using Fleet to send to a destination and it loses connectivity is there any sort of caching that goes on? I think perhaps it would stop removing results from the REDIS database - but I cannot find any information on how/when data is removed from there.
t

Ted Dorosheff

01/24/2022, 10:13 PM
by "destination" do you mean a client which is enrolled in FleetDM?
b

Benjamin Whetstone

01/24/2022, 10:43 PM
No, I'm a Fleet noob, so may not have the right terminology but if I'm using a Plugin to send the data to a 3rd part i.e. Devo or Splunk what happens if it can't reach that plugins destination - or is that something defined in the plugin?
zwass

zwass

01/24/2022, 10:45 PM
If Fleet can't send to the destination, it will return an error to osquery. This causes osquery to retry sending the logs. They're stored in osquery's internal buffer until they send successfully, or are expired after the
buffered_log_max
is exceeded.
b

Benjamin Whetstone

01/24/2022, 10:47 PM
Awesome, I appreciate you, to ask do you know if that behavior is documented anywhere?
b

Benjamin Whetstone

01/24/2022, 10:57 PM
Thanks again.