https://github.com/osquery/osquery logo
Title
e

Edward

04/28/2021, 2:01 AM
is it bad practice to run hourly snapshot queries across 50k different devices? Or should we limit snapshot queries to daily interval and only have differential queries be hourly?
z

zwass

04/28/2021, 3:40 PM
Not necessarily... If the volume of data going into your logging pipeline is worth it for the value you get then seems probably reasonable.
e

Edward

04/28/2021, 5:50 PM
gotcha, that's great to hear that I'm not crazy 🙂