Title
#fleet
z

Zach Zeid

11/19/2020, 12:38 PM
Is it feasible to use prometheus to build osquery performance dashboards, or is this just specificaly designed for resource metrics?
zwass

zwass

11/19/2020, 4:48 PM
Hmm, that's an interesting one. Not supported currently. I suppose we could have Fleet ingest data from
osquery_schedule
and output it in a format compatible with prometheus?
z

Zach Zeid

11/19/2020, 4:50 PM
Yeah, Currently I'm just creating a dashboard in splunk that kinda works. It's not super great but it's something. Ideally, I'd like to be able to pull those metrics from fleet itself, if fleet is going to be where I manage configs, packs, and hosts.
4:50 PM
I'm struggling to think how'd fleet would be able to ingest the data from
osquery_schedule
zwass

zwass

11/19/2020, 5:01 PM
I'm struggling to think how'd fleet would be able to ingest the data from 
osquery_schedule
Can you expand on this?
5:10 PM
Ideally, I'd like to be able to pull those metrics from fleet itself, if fleet is going to be where I manage configs, packs, and hosts.
This makes a lot of sense for Fleet. I'm definitely interested in hashing out how the info would best be exposed to users.
z

Zach Zeid

11/19/2020, 5:14 PM
I'm struggling to think how'd fleet would be able to ingest the data from 
osquery_schedule
Can you expand on this?
I'm just not 100% on implementation, given that results can be sent to other systems that are not stdout, how would fleet be able to get the results of those queries in a way that's exposable as a metric.
5:15 PM
Or would
osquery_schedule
be implicitly added to new rulepacks, and fleet could access it another way?
zwass

zwass

11/19/2020, 5:17 PM
Ah, because osquery can be configured to log to other plugins besides TLS? Right now we get around that by running queries that Fleet needs to see the results to as live queries (which always go over TLS). It's possible we may add features to Fleet at some point that would require scheduled query logs to go through the Fleet server as well. Potentially this could come with updates to osquery that would allow different packs to go to different logger plugins.
5:18 PM
As for
osquery_schedule
there wouldn't be much of a benefit to the differential results provided by scheduled queries, so I think we could pull the data as live queries without much concern.
z

Zach Zeid

11/19/2020, 5:22 PM
I understand. live queries are great, but scheduled queries are where it's at. We rely heavily on scheduled queries to poll endpoints that could benefit from gaining visibility into performance of those queries as they run.
zwass

zwass

11/19/2020, 5:28 PM
To be clear, Fleet could live query the
osquery_schedule
table and would get the data for the schedule queries. It would be an implementation detail really.
z

Zach Zeid

11/19/2020, 6:24 PM
oh, this was something I wasn't aware of. I was under the impression that I needed to include
osquery_schedule
in the scheduled query packs to get the perf data of those scheduled queries.
zwass

zwass

11/19/2020, 8:53 PM
Yeah for sure! Definitely try live querying that table to get insight into your scheduled queries.