https://github.com/osquery/osquery logo
Title
e

Erich Stoekl

03/17/2020, 8:44 PM
z

zwass

03/17/2020, 10:43 PM
Thousands, but it all depends on your configuration, scheduled queries, etc.
e

Erich Stoekl

03/17/2020, 11:45 PM
Is there a way to have master/replica setup for fleet? I need to use it to manage 100k+ hosts
Oh I see, multiple instances of fleet run behind a LB, then clients talk to the LB. In that case, how does the user interact with the UI frontend? Same LB endpoint?
c

Coleton

03/18/2020, 2:29 AM
@Erich Stoekl That's currently what I'm doing. I currently have 20k hosts connecting to a GKE hosted fleet deployment and it's running less than optimally, mostly related to the UI, which is currently open as a bug. However, the osquery results are stable (currently using the PubSub output for results) and I'm getting a lot of traffic as I'm using it on Linux servers for FIM.
e

Erich Stoekl

03/18/2020, 3:15 AM
@cole thanks for the info... very nice. Is there a helm chart for easy deployment of the fleet?
z

zwass

03/18/2020, 3:57 PM
I'm not aware of a Helm chart as of now. Please know that Fleet will fall over with 100k hosts right now but I am in the midst of working on some major refactoring that should scale it above that number.
e

Erich Stoekl

03/18/2020, 4:36 PM
Thanks @zwass. Do you mean a single box running fleet will fall over in that case? Or a cluster of fleet machines (all connected to the same mysql db) will not be able to handle 100k hosts?
z

zwass

03/18/2020, 4:37 PM
The latter. The problems are well known and are being addressed now.
e

Erich Stoekl

03/18/2020, 4:45 PM
Thank you!