Title
#general
j

jaredl

02/05/2018, 8:24 PM
Yeah I thought so as well, we’ve only got 15
file_paths
configured for watching and none of these appear to be directly related to the activities of
nagios
10:09 PM
So, the update on this is that it’s not any of the scheduled queries, I killed them all, and still get the same behavior.
10:09 PM
We currently have this in our
osquery.flags
file:
10:09 PM
--audit_allow_config=true
--audit_allow_sockets=true
--audit_persist=true
--disable_audit=false
--events_expiry=1
--events_max=100000
--logger_min_status=1
--logger_plugin=syslog
--watchdog_memory_limit=350
--watchdog_utilization_limit=100
10:10 PM
And the only setting I can change that actually makes the CPU usage drop below 100% is setting
--audit_allow_sockets=false
and restarting osquery
10:10 PM
Or leaving that alone and removing the
-a always,exit -S connect
kernel audit rule that
osqueryd
sets up.
10:14 PM
(shared this thread with #process-auditing to see if anyone there has ideas as well)