Title
#kolide
harveywells

harveywells

01/08/2019, 9:41 PM
Hello! Does Kolide Fleet’s distributed query feature have a default timeout?
zwass

zwass

01/08/2019, 10:51 PM
No. Queries will remain "active" (eg. will be executed on any targeted host that hasn't yet executed it) as long as the results page is open (or
fleetctl query
is still running).
l

leadZERO

01/09/2019, 2:01 AM
It might be nice to add a timeout parameter to fleetctl
2:01 AM
I don’t remember seeing one
zwass

zwass

01/09/2019, 2:11 AM
Can you tell me more about the use case/file an issue?
harveywells

harveywells

01/09/2019, 5:38 PM
@zwass we have a fairly large macOS fleet (1500+) and when running a distributed across the fleet we’d like to be able to only hit hosts that are online rather than Kolide attempting to query all hosts it’s aware of. I presume when using a distributed query Kolide attempts to query offline hosts as well?
5:39 PM
my assumption of how distributed queries work prompted the question.
zwass

zwass

01/09/2019, 5:40 PM
Are you using fleetctl or the web UI?
5:40 PM
Typically when you feel you have reached enough hosts you just stop the query.
harveywells

harveywells

01/09/2019, 5:42 PM
webUI @zwass
l

leadZERO

01/10/2019, 7:25 PM
I have a similar situation. I’d like to be able to automate using queries using fleetctl. Having it sit and spin forever makes that challenging
7:25 PM
Yes, I could try and come up with some signal trickery to SIGKILL it, but adding --timeout=600 would be much simpler on users
zwass

zwass

01/10/2019, 7:44 PM
I can see adding the timeout to fleetctl so that it can be used for automation. @harveywells Can you help me understand better what the use case would be int the web UI?
harveywells

harveywells

01/11/2019, 2:26 PM
@zwass just for a faster feedback loop. Some distributed queries have taken up to an hour to complete. We can take note of the online clients and stop the query once the appropriate amount of records have been returned but it would be nice for Kolide to handle this for us. +1 to @leadZERO’s idea of adding a timeout to
fleetctl
for query automation.
zwass

zwass

01/11/2019, 2:31 PM
I am convinced of the value of this for the
fleetctl query
command, and I think it will be pretty easy to implement. I created an issue to track that (https://github.com/kolide/fleet/issues/1987). If you are interested in similar functionality for the web UI, I would need to better understand what use case it enables that is not otherwise served.