https://github.com/osquery/osquery logo
Title
r

Ravi Shah

05/04/2020, 5:44 PM
Are there any reference docs to troubleshoot osquery performance issues on a Windows box? We have a user complaining that osquery is spiking cpu at max but I'm having hard time figuring out where to look for logs I'm reading thru osquery docs but haven't found answers yet
z

zwass

05/04/2020, 5:45 PM
r

Ravi Shah

05/04/2020, 5:48 PM
Thanks, I'll take a look. I'm trying to find where would I find watchdog events on a system locally so I could take a look
Out osquery log collection needs some work on Windows systems so we're missing lot of useful information in casese like this
n

nyanshak

05/04/2020, 8:59 PM
Just fyi - I had a case with Windows servers on AWS where an old version of cloudwatch log agent interacted poorly and caused high CPU. So like, major shot in the dark but... if you happen to have circumstances that line up like that, try updating the cloudwatch log agent. 🤷
r

Ravi Shah

05/04/2020, 11:35 PM
Thanks for the comment, I'll check it out
r

RyanE

05/11/2020, 11:47 PM
Hey @nyanshak this presentation specifically calles out the profile.py script to profile queries but that is not functional for Windows. Do you know a good alternative?
n

nyanshak

05/12/2020, 2:14 PM
I'm not super familiar with Windows-specific osquery issues. Would probably do better to post a question about profiling to #general or #windows. Maybe include why it's "not functional for Windows" 😕
r

RyanE

05/20/2020, 2:59 PM
It is just execution errors.
n

nyanshak

05/20/2020, 4:10 PM
What ^ does that mean? Did you manage to get profile.py working on Windows?
r

RyanE

06/01/2020, 3:09 AM
no, it means when you run profile.py on windows it throws errors during execution