Hello. anyone seeing osquery going crazy cpu with "osqueryd worker (pid) stopping: Maximum sustainaible utilization limit exceeded" and killed every 15sec or so? almost no other messages but a few hundred query results (network connections and process) vs 4k limit exceeded a day... trying to get more info on setup. Thanks
12/18/2018, 9:45 PM
you need to figure out which query or queries are causing the load.
strip down your config to minimal and build it up from there
12/18/2018, 10:05 PM
Thanks @packetzero would be nice but prod system that I can't even touch...
12/18/2018, 10:21 PM
you are going to have to touch the config at some point. Look at "SELECT name, interval, executions, output_size, wall_time, (user_time/executions) as avg_user_time, (system_time/executions) as avg_system_time, average_memory, last_executed FROM osquery_schedule;"
might give you insight on cpu and memory load
12/19/2018, 10:58 AM
clearly. added monitoring pack on my options. for now, trying to get system build-run book so I can minimize test iterations...