Probably a dumb question, but I see this when watc...
# general
Probably a dumb question, but I see this when watchdog kicks on
osqueryd: osqueryd worker (10022) stopping: Maximum sustainable CPU utilization limit exceeded: 12
it looks like osquery just diffs user_time and system_time to get that info, but my question is the
is that a time, like seconds, or milliseconds? if so, what is the metric?
That’s the amount of seconds that the CPU used by osquery exceeded the limit set in usage.
Which normally is 10% of the total CPU available
ok so it's in seconds, and is more or less a 1:1 ratio of time/cpu usage?
Sorry I’m not sure if I understood, but basically the watchdog has an interval where it checks for the CPU usage of the worker. Each time the CPU usage is > than the limit set via the
flag, it increases an internal counter, or resets it if the CPU usage is below the limit. That counter is then used to calculate that final number you see, using the configured check interval.
By default the limit on the sustained cpu usage is 12 seconds
ah I see, thanks!