Ian Muscat05/26/2021, 9:57 AM
table where there are a considerable amount of file events (600+ events) live queries via Fleet keep processing and never return results. Running the same query from inside of
on the host, returns results immediately. Are there any known issues/limitations around this, or would it make sense to try and reproduce this behavior further/more consistently? Thanks!
Noah Talerman05/26/2021, 1:32 PM
? In addition, do you mind filing an issue on GitHub with reproduction steps here? https://github.com/fleetdm/fleet/issues/new/choose
Ian Muscat05/26/2021, 1:34 PM
does the same “never return results” behavior also occur when running the query viaHmm that’s a good point, I have not tested that out. I’ll try and replicate this (this was observed on a production server, so I was limited in what I could test). Tuning the FIM config to monitor less files solved the issue though.
not just the UI — I get the same behaviour, I don’t think it is exclusively a UI issue. I’ve replicated the behaviour on tables other than
(I’ve been experiencing this behaviour on pretty much any table). Re-running the same query after a few minutes seems to “fix” the issue, but what is interesting is that there seems to be a spike in Fleet’s CPU usage whenever this “waiting” condition occurs (see attached image). I don’t see much in terms of Fleet logs. Not sure if it’s worth opening an issue with this information or if it’s worth collecting some more info/reproducing this issue more consistently (at the moment, I can’t reproduce this issue at will)?
Noah Talerman06/01/2021, 3:37 PM