Ian Muscat
05/26/2021, 9:57 AMfile_events
table where there are a considerable amount of file events (600+ events) live queries via Fleet keep processing and never return results. Running the same query from inside of osqueryi
on the host, returns results immediately. Are there any known issues/limitations around this, or would it make sense to try and reproduce this behavior further/more consistently? Thanks!Noah Talerman
05/26/2021, 1:32 PMfleetctl
?
In addition, do you mind filing an issue on GitHub with reproduction steps here? https://github.com/fleetdm/fleet/issues/new/chooseIan Muscat
05/26/2021, 1:34 PMdoes the same “never return results” behavior also occur when running the query viaHmm that’s a good point, I have not tested that out. I’ll try and replicate this (this was observed on a production server, so I was limited in what I could test). Tuning the FIM config to monitor less files solved the issue though.fleetctl
fleetctl
not just the UI — I get the same behaviour, I don’t think it is exclusively a UI issue.
I’ve replicated the behaviour on tables other than file_events
(I’ve been experiencing this behaviour on pretty much any table).
Re-running the same query after a few minutes seems to “fix” the issue, but what is interesting is that there seems to be a spike in Fleet’s CPU usage whenever this “waiting” condition occurs (see attached image). I don’t see much in terms of Fleet logs.
Not sure if it’s worth opening an issue with this information or if it’s worth collecting some more info/reproducing this issue more consistently (at the moment, I can’t reproduce this issue at will)?Noah Talerman
06/01/2021, 3:37 PM