Yash Boura

08/02/2021, 5:38 AM
How does the UI make an “on-demand” QUERY to the client OSQuery nodes - how long does the request take to be sent to the node? Can you send 1 query to 1000s or millions of nodes or is it 1-1 everytime?


08/02/2021, 3:08 PM
osquery itself does not really have a UI. So I suspect this is a #fleet question?
Mystery Incorporated

Mystery Incorporated

08/03/2021, 7:00 AM
@Yash Boura I answer for you in #fleet 🙂
7:02 AM
But the long and short of it is you specify an interval time, and osqueryd checks in to fleet every time that interval has lapsed, to see if it has any queries to execute. That's why sometimes the query can execute in 1 second, and another time it can execute in the full time of your specified interval.