Title
#general
s

sanjaykcse

08/09/2020, 12:28 PM
If worker thread is executing a live query request and the CPU/memory exceeds the set limit, does watchdog thread kill the worker thread or the monitoring by watchdog thread is limited to scheduled queries only?
theopolis

theopolis

08/09/2020, 2:14 PM
It will kill it unfortunately, the watcher process is very "dumb" so to speak.
a

alessandrogario

08/10/2020, 9:11 AM
re: watcher. I was thinking about adding perf tracing in there so that1. we can tell whether it's stuck or just busy 2. save the stacktrace before we kill the worker of course this would only work on Linux. Thoughts? Bad idea?
theopolis

theopolis

08/10/2020, 12:45 PM
That sounds amazing. I’m also curious if we can do a lot of good with a better systemd unit, which configures proper performance limits for osquery.
zwass

zwass

08/10/2020, 4:08 PM
One issue I remember related to this is that the watcher may kill the worker, but then it will restart and retrieve the same live query from the server. There's no way for the server to know that it failed because of this.
s

sanjaykcse

08/11/2020, 2:06 PM
In case of scheduled queries, when the worker thread picks up the interrupted /incomplete during last execution query , it blacklists that query ? Does that policy not apply for the live query ?
zwass

zwass

08/11/2020, 5:07 PM
Correct