Hi guys,
In my organization there is Windows DC׳s ...
# generale
ET
03/02/2021, 8:11 PMHi guys,
In my organization there is Windows DC׳s servers with a lot of login users (around 50 users).
When I tried to ask query from users or logged_in_users table the process was hang until I kill the process.
Anyone meet this? An idea for a solution?
osquery 4.3.0
m
Mike Myers
03/02/2021, 10:20 PMI did put in some speedups to the
users👍 1
e
ET
03/03/2021, 11:05 AMHi @Mike Myers,
When I ask Users from my DC Server I got all of the users under this domain.
Is this the desired behavior?
m
Mike Myers
03/03/2021, 4:02 PMI don't know enough about the desired behavior on domain controllers, but, which table is it that your'e using?
e
ET
03/03/2021, 4:03 PM Copy code
select * from usersm
Mike Myers
03/03/2021, 4:04 PMah, ok.
userse
ET
03/03/2021, 4:04 PMSo I tell you the problem
m
Mike Myers
03/03/2021, 4:05 PMmaybe the
typee
ET
03/03/2021, 4:05 PMWhen I run this query I have like 32K users on DC - this is include the all org users.
ET
03/03/2021, 4:05 PMThis process hang for long time
ET
03/03/2021, 4:06 PMeven if i add “limit 1” to the query
m
Mike Myers
03/03/2021, 5:59 PMyea, that's how it was before. I believe if you try the 4.6 release you won't have that problem anymore
Mike Myers
03/03/2021, 5:59 PMit was inefficient, before