Hello, if someone run the performance related que...
# fleetd
dram
02/19/2025, 1:26 AMHello, if someone run the performance related query which hit the threshold and killed by watchdog, In UI we got the message " distributed query is denylisted" is there any way to track how many query or host have this issue? how to rectify this ?
u
Unthread
02/19/2025, 5:26 PMIn the Fleet logs, you can see denylisted distributed queries, including the host id.
Unthread
02/19/2025, 5:34 PMTypically, I'd expect this to be a bigger concern with scheduled queries since you don't get that error in the Fleet UI for those. There, you can query the osquery_schedule table to get a good picture:SELECT * FROM osquery_schedule WHERE denylisted=1