Title
#general
z

Zach Zeid

11/03/2021, 8:12 PM
Probably a dumb question, but I see this when watchdog kicks on
osqueryd: osqueryd worker (10022) stopping: Maximum sustainable CPU utilization limit exceeded: 12
it looks like osquery just diffs user_time and system_time to get that info, but my question is the
12
is that a time, like seconds, or milliseconds? if so, what is the metric?
Stefano Bonicatti

Stefano Bonicatti

11/03/2021, 8:36 PM
That’s the amount of seconds that the CPU used by osquery exceeded the limit set in usage.
8:37 PM
Which normally is 10% of the total CPU available
z

Zach Zeid

11/03/2021, 8:38 PM
ok so it's in seconds, and is more or less a 1:1 ratio of time/cpu usage?
Stefano Bonicatti

Stefano Bonicatti

11/03/2021, 8:55 PM
Sorry I’m not sure if I understood, but basically the watchdog has an interval where it checks for the CPU usage of the worker. Each time the CPU usage is > than the limit set via the
watchdog_utilization_limit
flag, it increases an internal counter, or resets it if the CPU usage is below the limit. That counter is then used to calculate that final number you see, using the configured check interval.
8:55 PM
By default the limit on the sustained cpu usage is 12 seconds
z

Zach Zeid

11/03/2021, 8:56 PM
ah I see, thanks!