Are there any existing stats around memory resident size of osquery without any queries/packs enabled?
Curious to hear how much cpu/mem resources folks usually give to osquery in your production fleet.
05/11/2020, 11:47 PM
Currently allowing 1GB for osquery in my deployment. Setting that limit at the cgroup in systemd.
05/11/2020, 11:48 PM
That said osquery would use waaaaayyyy less than that with no queries/packs enabled.
05/11/2020, 11:49 PM
True. We are seeing current usage in the 10MB range with no scheduled queries
Correction -- 50 MB range. Just checked
05/12/2020, 12:31 AM
I don’t have numbers handy, but it’s pretty small. It’s all in the queries, and what they trigger
05/12/2020, 4:04 AM
Thanks for sharing some rough numbers :) We are also seeing somewhere around ~60MB with little/no scheduled queries.