Daniel Cross
05/16/2022, 4:49 AMLucas Rodriguez
05/16/2022, 4:23 PMWe’re looking at a 50-80k node fleet (mostly Linux, some Mac, mostly in one region but overall globally distributed)We know of users that are using fleet with 100k+ devices. And (last I checked) we generally load test each release of fleet with ~100k devices.
My current thinking for alternative is to tely mostly on scheduled queries for most of what we’re afterFleet support scheduled queries (and grouping them by packs). https://fleetdm.com/docs/using-fleet/faq#scheduled-queries
running osquery queries direct via batch ssh when neededNo need for ssh. Fleet has support for what we call "live queries", basically allows you to write a query and execute it on all (or a subset) of the online hosts.
Daniel Cross
05/17/2022, 3:41 AMLucas Rodriguez
05/17/2022, 11:53 AM