Ayan
07/30/2021, 2:53 PMWHERE
clause of the query? if that's the case, wouldn't having a larger set of labels affect the performance of all of the devices enrolled in fleet even though the labels are not intended to target all of them?zwass
07/30/2021, 7:29 PMAyan
07/30/2021, 7:32 PMosquery_status
logs seems to suggest the refresh interval might be way less than 1 hour which I think is the default. It is quite strange because we have not specified an interval for it at the moment and it should run default 1 hr.Rachel Perkins
07/30/2021, 9:09 PMAyan
07/30/2021, 9:11 PMzwass
07/30/2021, 9:32 PMAyan
07/30/2021, 9:51 PMosquery_status
logs on the fleet server. Here's an example log with redacted output:{
"hostIdentifier": "<UUID>",
"calendarTime": "Fri Jul 30 14:01:42 2021 UTC",
"unixTime": "1627653702",
"severity": "0",
"filename": "distributed.cpp",
"line": "121",
"message": "Executing distributed query: fleet_label_query_36: SELECT address FROM interface_addresses\nWHERE address IN (ABOUT 100 IPs);",
"version": "4.8.0",
"decorations": {
"host_uuid": "<UUID>",
"hostname": "<endpoint>"
}
}
Jul 30 19:35:25 <http://kolide-fleet1.xyz.com|kolide-fleet1.xyz.com> fleet[1441]: {"component":"service","err":"failed to save labels: insert label query executions: Error 1452: Cannot add or update a child row: a foreign key constraint fails (`kolide_infra`.`label_membership`, CONSTRAINT `fk_lm_label_id` FOREIGN KEY (`label_id`) REFERENCES `labels` (`id`) ON DELETE CASCADE ON UPDATE CASCADE)","ip_addr":"[IPv6 address of an device]:35338","level":"info","method":"SubmitDistributedQueryResults","took":"3.852295ms","ts":"2021-07-30T23:35:25.610662952Z","x_for_ip_addr":""}
Any thoughts if the two issues might be directly related?zwass
08/03/2021, 7:32 PM