Title
#kolide
v

vaar

06/18/2020, 7:38 AM
hello, I have a kolide deployment with 4 fleet (same mysql cluster) behind a LB, around 10k osquery hosts are connected to the LB IP, when I run an on-demand query on a fleet console (so I connect to LB and then to a random fleet instance), I got the first 2/3k hosts result quickly and after it got stuck... is it possible that the osquery agents are sending the results to another fleet instance because the LB switched to a different fleet IP?
zwass

zwass

06/18/2020, 4:08 PM
Are all the Fleet instances connected to the same Redis server? If so, it doesn't matter which LB receives the result. Are you able to retrieve more results if you use
fleetctl query
? The web UI can end up slowing down after it is rendering a lot of results.
v

vaar

06/18/2020, 6:32 PM
yes, with fleetctl I see all results, so it is a web UI issue
6:34 PM
if I try to scale also redis server I can have some results loss?
zwass

zwass

06/18/2020, 9:56 PM
You need a single "logical" instance of Redis. I believe there are clustering strategies you can use.