https://github.com/osquery/osquery logo
Title
e

Erich Stoekl

05/19/2020, 4:47 PM
Question about labels -- will there be a performance degradation after adding too many labels? I am thinking about adding ~1050 labels to my Fleet server. Is this too many?
s

sundsta

05/19/2020, 5:00 PM
That’s 1050 additional queries each of your hosts will run. Whether or not that is too much depends largely on your hosts. I don’t expect it to be too much of a problem on Fleet’s end
e

Erich Stoekl

05/19/2020, 5:08 PM
Thanks @sundsta. Do you know how often the queries will run?
z

zwass

05/19/2020, 5:11 PM
It's an interval you can configure.
--osquery_label_update_interval
IIRC.
e

Erich Stoekl

05/19/2020, 5:17 PM
Thanks!
judging by the logs on an osquery node, it executes once per hour