https://github.com/osquery/osquery logo
Title
a

Ahmed

12/22/2019, 8:05 PM
Hey Folks, Apologies for repeating my question, but its different purpose. How do you handle large deployment, specially with: • distributed query timing config • Interactive query results (huge for a browser to handle no paging & is it logged by default ) • how frequent agent connect to fleet specially in large deployment Appreciated
n

nyanshak

12/23/2019, 5:27 AM
I also would like to know if anyone has managed to do this well... We have a large deployment but have run into issues where we've basically just decided that ad-hoc / distributed queries against large numbers of hosts are infeasible, and we work around it by scheduling packs to run the queries that we want to run. It's... unfortunate.
1
a

Ahmed

12/24/2019, 11:19 AM
@christran