Dan Achin

Dan Achin

03/24/2021, 7:19 PM
Hello everyone. We are experiencing a very strange issue with some of our osquery clients (both Windows and Mac) where they send massive amounts of data to Fleet - 1 - 3 GB per hour. The bandwidth usage is orders of magnitude more than the size of the events on disk (in logs) and in our backend Splunk infra. We are still investigating, but we were able to get a pcap from a Windows client while it was happening and we see osquery sending each packet 5 - 7 times, which then causes Fleet to respond 5 - 7 times. Has anyone experienced anything like this? I've opened https://github.com/osquery/osquery/issues/7021 and planned to bring it to office hours next week.
5:58 PM
Follow up - are the .sst files that (I think) make up rocks.db data supposed to be deleted or rotated?