RPuth11/06/2018, 6:20 PM
zwass11/06/2018, 6:43 PM
Martijn Bakkes11/06/2018, 6:46 PM
zwass11/06/2018, 6:47 PM
Martijn Bakkes11/06/2018, 6:48 PM
zwass11/06/2018, 6:51 PM
Martijn Bakkes11/06/2018, 6:55 PM
RPuth11/06/2018, 6:55 PM
zwass11/06/2018, 7:00 PM
Martijn Bakkes11/06/2018, 7:04 PM
zwass11/06/2018, 7:08 PM
? This is likely to unnecessarily increase the load on the Fleet server. Do you have your Fleet server horizontally scaled? What does the CPU usage look like on the Fleet server? What does the CPU usage look like on the MySQL server?
RPuth11/06/2018, 7:17 PM
zwass11/06/2018, 7:23 PM
RPuth11/06/2018, 7:28 PM
to return an exact count of 457 per server. Now, running the query towards a single target returned a beautiful result of 457 within a 1 second time frame. Although, when running against 100 hosts it returned the desired total count of 45700 but over 84 seconds (logger_tls_period was within the range of 1 -> 10 during that test)
SELECT * FROM file WHERE directory="/usr/bin/"
zwass11/06/2018, 7:29 PM
Martijn Bakkes11/06/2018, 7:33 PM
zwass11/06/2018, 7:34 PM
Martijn Bakkes11/06/2018, 7:37 PM
zwass11/06/2018, 7:37 PM
What was the interval you set on the query?
Martijn Bakkes11/06/2018, 7:38 PM
zwass11/06/2018, 7:38 PM
RPuth11/06/2018, 7:42 PM
zwass11/06/2018, 7:42 PM
zwass11/06/2018, 7:56 PM
. This means that it may take up to 60s for a host to receive a new query you schedule.
RPuth11/06/2018, 8:10 PM
zwass11/06/2018, 8:13 PM
in the 60s range. To simulate this on the smaller number of hosts you might try 1-5s.