Hi again.
I'm circling back on this issue as it's still present, and I think it likely relates to a 32MB per minute hard limit for redis pubsub channels.
https://osquery.slack.com/archives/C01DXJL16D8/p1646091488658029
We're executing a query against the /api/v1/fleet/queries/run_by_names endpoint, and then using a websocket to collect results.
Is executing queries with large result sets this way not particularly feasible?
👀 1
l
Luke Heath
03/04/2022, 9:31 PM
Hi Jason, I don't know the answer but I'm posing the question to our fleetctl team to get some clarity for you.
j
Jason Cetina
03/04/2022, 10:23 PM
Thanks Luke. LMK if you need more info, etc. Very much appreciate the response.
l
Luke Heath
03/04/2022, 10:38 PM
Sure thing! It may be Monday before I have an answer for you. Much of our backend team is out for the weekend.
j
Jason Cetina
03/04/2022, 11:18 PM
and also, as long as I have your attention, we found this as well. it's not super urgent for us, but thought you might want to know...
https://github.com/fleetdm/fleet/issues/4469
k
koo
03/07/2022, 5:11 AM
Thanks @Jason Cetina for pointing out that issue. I’ll do well to track it 🙂
l
Luke Heath
03/07/2022, 4:25 PM
@Jason Cetina Thank you for filing that bug! We are fixing it for the release going out today.
Regarding the live query issue you initially reported, our backend team is looking into the issue this morning. I will update you as soon as we have something to share.