Is it feasible to use prometheus to build osquery performance dashboards, or is this just specificaly designed for resource metrics?

Hmm, that's an interesting one. Not supported currently. I suppose we could have Fleet ingest data from

osquery_schedule

and output it in a format compatible with prometheus?

Yeah, Currently I'm just creating a dashboard in splunk that kinda works. It's not super great but it's something. Ideally, I'd like to be able to pull those metrics from fleet itself, if fleet is going to be where I manage configs, packs, and hosts.

I'm struggling to think how'd fleet would be able to ingest the data from 

osquery_schedule

Can you expand on this?

I'm struggling to think how'd fleet would be able to ingest the data from 

osquery_schedule

Can you expand on this?

I'm just not 100% on implementation, given that results can be sent to other systems that are not stdout, how would fleet be able to get the results of those queries in a way that's exposable as a metric.

Ah, because osquery can be configured to log to other plugins besides TLS? Right now we get around that by running queries that Fleet needs to see the results to as live queries (which always go over TLS). It's possible we may add features to Fleet at some point that would require scheduled query logs to go through the Fleet server as well. Potentially this could come with updates to osquery that would allow different packs to go to different logger plugins.

I understand. live queries are great, but scheduled queries are where it's at. We rely heavily on scheduled queries to poll endpoints that could benefit from gaining visibility into performance of those queries as they run.

To be clear, Fleet could live query the

osquery_schedule

table and would get the data for the schedule queries. It would be an implementation detail really.

oh, this was something I wasn't aware of. I was under the impression that I needed to include

osquery_schedule

in the scheduled query packs to get the perf data of those scheduled queries.

Yeah for sure! Definitely try live querying that table to get insight into your scheduled queries.