Hello, We use Fleet Free with no license. starting today, we have a tons of logs :

GET /api/latest/fleet/device/<id>/policies

resulting to error from Fleet :

Requires Fleet Premium license

Several occurences by day (~7K), not a problem until today and we are at this moment above 5 M! Fleet server is under a big load (we mitigate by adding a 404 redirection on nginx conf). We do not change anything on Fleet server side (version

4.20.0

), and on client side we use Fleet-Desktop with updates enabled. We see that osquery 5.6.0 has been released but only 2 clients have been updated over ~200. We don't understand how and why it happens since today (tons of requests starts at 00h). Do you have any information or things we can check ?

The newest version of Fleet Desktop uses that endpoint in the background. It sounds like that update might have applied to additional hosts, increasing the number of calls.

Indeed, Fleet Desktop is now on version

1.3.0

on many clients since today. We have only ~130 active hosts maximum at same time, do you think there is a fix to do ? (I can create the ticket in github if necessary) Because there is a very big flood of logs making fleet under heavy load (cpu very high but not full on a t3.small aws instance), but this is surprising if I'm the only one with this 🤔

It’s definitely surprising that it’s causing that much load. While this is the first I’ve heard about it causing issues, I’m going to bring it up during my meeting with the product team today to see if there’s a way we could control use of that endpoint with a flag.

ok perfect 👌

@Jerome thanks so much for reaching out about this. I just submitted a PR with a fix https://github.com/fleetdm/fleet/pull/8396, I will let you know as soon as it goes out

Thank you for your responsiveness 🙂

Hey @Jerome just wanted to let you know that we released Fleet Desktop v1.3.1 on Friday with a fix for this to the

stable

channel.

Thanks for the very quick update 🙂 Our agents did the update and all is good like before 👍