Hi again.
I'm circling back on this issue as it's still present, and I think it likely relates to a 32MB per minute hard limit for redis pubsub channels.
https://osquery.slack.com/archives/C01DXJL16D8/p1646091488658029
We're executing a query against the /api/v1/fleet/queries/run_by_names endpoint, and then using a websocket to collect results.
Is executing queries with large result sets this way not particularly feasible?
👀 1
l
Luke Heath
03/04/2022, 9:31 PM
Hi Jason, I don't know the answer but I'm posing the question to our fleetctl team to get some clarity for you.
j
Jason Cetina
03/04/2022, 10:23 PM
Thanks Luke. LMK if you need more info, etc. Very much appreciate the response.
l
Luke Heath
03/04/2022, 10:38 PM
Sure thing! It may be Monday before I have an answer for you. Much of our backend team is out for the weekend.
j
Jason Cetina
03/04/2022, 11:18 PM
and also, as long as I have your attention, we found this as well. it's not super urgent for us, but thought you might want to know...
https://github.com/fleetdm/fleet/issues/4469
k
koo
03/07/2022, 5:11 AM
Thanks @Jason Cetina for pointing out that issue. I’ll do well to track it 🙂
l
Luke Heath
03/07/2022, 4:25 PM
@Jason Cetina Thank you for filing that bug! We are fixing it for the release going out today.
Luke Heath
03/07/2022, 4:27 PM
Regarding the live query issue you initially reported, our backend team is looking into the issue this morning. I will update you as soon as we have something to share.