https://github.com/osquery/osquery logo
Title
m

Mayank

05/11/2020, 9:57 PM
Are there any existing stats around memory resident size of osquery without any queries/packs enabled? Curious to hear how much cpu/mem resources folks usually give to osquery in your production fleet.
e

Erich Stoekl

05/11/2020, 11:47 PM
Currently allowing 1GB for osquery in my deployment. Setting that limit at the cgroup in systemd.
z

zwass

05/11/2020, 11:48 PM
That said osquery would use waaaaayyyy less than that with no queries/packs enabled.
e

Erich Stoekl

05/11/2020, 11:49 PM
True. We are seeing current usage in the 10MB range with no scheduled queries
Correction -- 50 MB range. Just checked
👍 1
s

seph

05/12/2020, 12:31 AM
I don’t have numbers handy, but it’s pretty small. It’s all in the queries, and what they trigger
👍 1
m

Mayank

05/12/2020, 4:04 AM
Thanks for sharing some rough numbers :) We are also seeing somewhere around ~60MB with little/no scheduled queries.