Hello all I m trying to stand up osquery on prem How many se

Question

Hello all I m trying to stand up osquery on prem How many servers would I need for about 30 000 endpoints I understand that I can use Scale Sets in Azure but am trying to set up a test environment with a budget of $0 Any advice would be appreciated

nyanshak · Answer

how many servers would depend on the size configuration of the servers also will heavily depend on check in intervals number of queries how you log data if you are going to try to do ad hoc querying

nyanshak · Answer

pretty hard to answer that question since your environment will be unique

nyanshak · Answer

for perspective I have similar number of hosts but split across multiple fleet deployments AWS each of the deployments will have 3 20 c5 2xlarge instances + db m5 4xlarge DB majority of the time they ll be scaled to like 3 instances but I ve definitely run scenarios during load testing that s pushed it to 20 instances

nyanshak · Answer

and I ve found ad hoc queries to generally be extremely problematic to the point it doesn t really matter how much I ve scaled the DB and I ve disabled them

nyanshak · Answer

we use to manage see < C1XCLA5DZ|kolide>

Eric Brue · Answer

Thanks for your insite Appreciate it