Title
#general
k

Konstantin

06/20/2019, 8:55 PM
Hello, I have CPU 100% osqueryd issue within ~5% of my linux servers. I see messages like “osqueryd worker (31531) stopping: Maximum sustainable CPU utilization limit exceeded: 12” every ~15 seconds and distributed query not working. I try to add “watchdog_memory_limit: 550", “watchdog_utilization_limit: 720”, “watchdog_delay: 480" and even “disable_watchdog: true” parameter, but nothing changed. How can I fix the issue?
9:01 PM
systemctl set-property osqueryd.service CPUQuota=5%
solve the issue (tried only on one host). But I want to fix the issue on osquery side. Also there are some opened issue without solution like https://github.com/osquery/osquery/issues/5234.
sundsta

sundsta

06/20/2019, 11:00 PM
I saw similar when the local database was corrupted. Stopping the service, deleting the local
osquery.db
, and restarting the service resolved the issue
clong

clong

06/21/2019, 1:45 PM
@Konstantin i'm guessing you have auditing and/or file events enabled?