Title
#general
m

Mayank

05/11/2020, 9:57 PM
Are there any existing stats around memory resident size of osquery without any queries/packs enabled? Curious to hear how much cpu/mem resources folks usually give to osquery in your production fleet.
Erich Stoekl

Erich Stoekl

05/11/2020, 11:47 PM
Currently allowing 1GB for osquery in my deployment. Setting that limit at the cgroup in systemd.
zwass

zwass

05/11/2020, 11:48 PM
That said osquery would use waaaaayyyy less than that with no queries/packs enabled.
Erich Stoekl

Erich Stoekl

05/11/2020, 11:49 PM
True. We are seeing current usage in the 10MB range with no scheduled queries
11:52 PM
Correction -- 50 MB range. Just checked
s

seph

05/12/2020, 12:31 AM
I don’t have numbers handy, but it’s pretty small. It’s all in the queries, and what they trigger
m

Mayank

05/12/2020, 4:04 AM
Thanks for sharing some rough numbers 😃 We are also seeing somewhere around ~60MB with little/no scheduled queries.