hello, I have a kolide deployment with 4 fleet (same mysql cluster) behind a LB, around 10k osquery hosts are connected to the LB IP, when I run an on-demand query on a fleet console (so I connect to LB and then to a random fleet instance), I got the first 2/3k hosts result quickly and after it got stuck... is it possible that the osquery agents are sending the results to another fleet instance because the LB switched to a different fleet IP?
06/18/2020, 4:08 PM
Are all the Fleet instances connected to the same Redis server? If so, it doesn't matter which LB receives the result. Are you able to retrieve more results if you use
? The web UI can end up slowing down after it is rendering a lot of results.
06/18/2020, 6:32 PM
yes, with fleetctl I see all results, so it is a web UI issue
if I try to scale also redis server I can have some results loss?
06/18/2020, 9:56 PM
You need a single "logical" instance of Redis. I believe there are clustering strategies you can use.