Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
z
Zach Zeid
11/19/2020, 12:38 PMIs it feasible to use prometheus to build osquery performance dashboards, or is this just specificaly designed for resource metrics?
z
zwass
11/19/2020, 4:48 PMHmm, that's an interesting one. Not supported currently. I suppose we could have Fleet ingest data from
osquery_schedulez
Zach Zeid
11/19/2020, 4:50 PMYeah, Currently I'm just creating a dashboard in splunk that kinda works. It's not super great but it's something.
Ideally, I'd like to be able to pull those metrics from fleet itself, if fleet is going to be where I manage configs, packs, and hosts.
I'm struggling to think how'd fleet would be able to ingest the data from
osquery_schedulez
zwass
11/19/2020, 5:01 PMI'm struggling to think how'd fleet would be able to ingest the data fromCan you expand on this?osquery_schedule
Ideally, I'd like to be able to pull those metrics from fleet itself, if fleet is going to be where I manage configs, packs, and hosts.This makes a lot of sense for Fleet. I'm definitely interested in hashing out how the info would best be exposed to users.
z
Zach Zeid
11/19/2020, 5:14 PMI'm struggling to think how'd fleet would be able to ingest the data fromosquery_schedule
Can you expand on this?I'm just not 100% on implementation, given that results can be sent to other systems that are not stdout, how would fleet be able to get the results of those queries in a way that's exposable as a metric.
Or would
osquery_schedulez
zwass
11/19/2020, 5:17 PMAh, because osquery can be configured to log to other plugins besides TLS? Right now we get around that by running queries that Fleet needs to see the results to as live queries (which always go over TLS). It's possible we may add features to Fleet at some point that would require scheduled query logs to go through the Fleet server as well. Potentially this could come with updates to osquery that would allow different packs to go to different logger plugins.
As for
osquery_schedulez
Zach Zeid
11/19/2020, 5:22 PMI understand. live queries are great, but scheduled queries are where it's at. We rely heavily on scheduled queries to poll endpoints that could benefit from gaining visibility into performance of those queries as they run.
z
zwass
11/19/2020, 5:28 PMTo be clear, Fleet could live query the
osquery_schedule👍 1
z
Zach Zeid
11/19/2020, 6:24 PMoh, this was something I wasn't aware of. I was under the impression that I needed to include
osquery_schedulez
zwass
11/19/2020, 8:53 PMYeah for sure! Definitely try live querying that table to get insight into your scheduled queries.