Title
#kolide
a

Alejandro

03/13/2020, 10:47 AM
👋 is there any way to know “remotely” if the watcher stopped the query because of memory or CPU limit? Locally I can see the log
osqueryd worker (11044) stopping: Maximum sustainable CPU utilization limit exceeded
but I cannot find that info on the status logs neither the
osquery_table
on blacklisted ones. That will help us on further tuning the watcher config in the daemons.
s

seph

03/13/2020, 12:15 PM
Does that appear in the osquery_schedule table? (I'm not near a real computer) You can parse logs remotely.
zwass

zwass

03/13/2020, 5:54 PM
This is probably best to be a feature request against osquery.
a

Alejandro

03/16/2020, 11:08 AM
@seph can you provide more details on the parse logs remotely? @zwass I will also share it on the general channel, thanks