https://github.com/osquery/osquery logo
Title
j

Jason Cetina

03/04/2022, 8:50 PM
Hi again. I'm circling back on this issue as it's still present, and I think it likely relates to a 32MB per minute hard limit for redis pubsub channels. https://osquery.slack.com/archives/C01DXJL16D8/p1646091488658029 We're executing a query against the /api/v1/fleet/queries/run_by_names endpoint, and then using a websocket to collect results. Is executing queries with large result sets this way not particularly feasible?
👀 1
l

Luke Heath

03/04/2022, 9:31 PM
Hi Jason, I don't know the answer but I'm posing the question to our fleetctl team to get some clarity for you.
j

Jason Cetina

03/04/2022, 10:23 PM
Thanks Luke. LMK if you need more info, etc. Very much appreciate the response.
l

Luke Heath

03/04/2022, 10:38 PM
Sure thing! It may be Monday before I have an answer for you. Much of our backend team is out for the weekend.
j

Jason Cetina

03/04/2022, 11:18 PM
and also, as long as I have your attention, we found this as well. it's not super urgent for us, but thought you might want to know... https://github.com/fleetdm/fleet/issues/4469
k

koo

03/07/2022, 5:11 AM
Thanks @Jason Cetina for pointing out that issue. I’ll do well to track it 🙂
l

Luke Heath

03/07/2022, 4:25 PM
@Jason Cetina Thank you for filing that bug! We are fixing it for the release going out today.
Regarding the live query issue you initially reported, our backend team is looking into the issue this morning. I will update you as soon as we have something to share.