Daniel Cross05/16/2022, 4:49 AM
Lucas Rodriguez05/16/2022, 4:23 PM
We’re looking at a 50-80k node fleet (mostly Linux, some Mac, mostly in one region but overall globally distributed)We know of users that are using fleet with 100k+ devices. And (last I checked) we generally load test each release of fleet with ~100k devices.
My current thinking for alternative is to tely mostly on scheduled queries for most of what we’re afterFleet support scheduled queries (and grouping them by packs). https://fleetdm.com/docs/using-fleet/faq#scheduled-queries
running osquery queries direct via batch ssh when neededNo need for ssh. Fleet has support for what we call "live queries", basically allows you to write a query and execute it on all (or a subset) of the online hosts.
Daniel Cross05/17/2022, 3:41 AM
Lucas Rodriguez05/17/2022, 11:53 AM