defensivedepth01/08/2020, 4:33 PM
---- Performance limit level (0=normal, 1=restrictive, -1=disabled). The watchdog process uses a "level" to configure performance limits. The level limits are as follows: Memory: default 200M, restrictive 100M CPU: default 25% (for 9 seconds), restrictive 18% (for 9 seconds) The normal level allows for 10 restarts if the limits are violated. The restrictive allows for only 4, then the service will be disabled. For both there is a linear backoff of 5 seconds, doubling each retry. ----- Is this saying that after 10 / 4 restarts of the worker process, the osqueryd service will be disabled? I have tested this on a Win10 system and am not seeing this behavior, just the query being put on the blocklist and the worker process being restarted - I am not seeing any kind of backoff either.
defensivedepth01/09/2020, 3:54 PM