https://github.com/osquery/osquery logo
Join Slack
Powered by
Is there a way to set the timeout duration for liv...
# fleet
o
Is there a way to set the timeout duration for live queries? I'm using Fleet v4.60.1 and osquery v5.13.1
k
Hi @Ortal Kombat , You can set this using and environment variable:
Copy code
FLEET_LIVE_QUERY_REST_PERIOD
The default is 25 seconds.
l
2 cents: That period is for the synchronous live queries API. Not the one that uses websockets.
k
I was just grabbing a link for that :)
o
Is there a way to set it for the API that uses websockets?
Or any plans to allow that in future releases? That could really be helpful for me
l
If you close the connection to the websocket, then the live query will expire (results will be ignored and query won't be sent to new hosts)
Is there a way to set the timeout duration for live queries?
Or do you mean to control the duration of the queries execution on the hosts?
o
I'm using websockets, and I receive status "finished" and no results, when the query is still not finished on the client
l
Mhm... that's weird, if there's an online host that hasn't returned results then Fleet should wait for such host...
UI, fleetctl, or some tool that uses the API?
o
With Python
A tool that I created
I'm really sorry but I must go now, I'll be happy to continue this conversation tomorrow🙏
l
Worth taking a look at how 
fleetctl
implemented live queries using the websockets API.
o
Thanks @Lucas Rodriguez, I'll try that! But just to understand - using the websockets API, there's no timeout for a live query? It should wait forever until the host submits results?
5 Views
Open in Slack
PreviousNext
Powered by