https://github.com/osquery/osquery logo
Title
e

Eric Brue

03/19/2020, 6:53 PM
Hello all. I'm trying to stand up osquery on-prem. How many servers would I need for about 30,000 endpoints? I understand that I can use Scale Sets in Azure but am trying to set up a test environment with a budget of $0. Any advice would be appreciated.
z

zwass

03/19/2020, 7:46 PM
for 30k endpoints you'll need a handful of servers and a beefy mysql. For setting up a test env, check out https://github.com/dactivllc/osquery-in-a-box
e

Eric Brue

03/19/2020, 7:57 PM
Thanks for your quick response. Can you estimate the number of servers I may need? I will check out that link.
z

zwass

03/20/2020, 7:10 PM
4-6 perhaps? Depends on so many factors.
e

Erich Stoekl

03/24/2020, 12:07 AM
@zwass What are some of those factors?
z

zwass

03/24/2020, 12:11 AM
Intervals set for logging, config retrieval, and distributed query checkins will play a large role. Also how many distributed queries you actually run, how many labels you create, the volume of logs being pushed from scheduled queries.
👍 2