Are there any reference docs to troubleshoot osquery performance issues on a Windows box?
We have a user complaining that osquery is spiking cpu at max but I'm having hard time figuring out where to look for logs
I'm reading thru osquery docs but haven't found answers yet
Thanks, I'll take a look. I'm trying to find where would I find watchdog events on a system locally so I could take a look
Out osquery log collection needs some work on Windows systems so we're missing lot of useful information in casese like this
05/04/2020, 8:59 PM
Just fyi - I had a case with Windows servers on AWS where an old version of cloudwatch log agent interacted poorly and caused high CPU.So like, major shot in the dark but... if you happen to have circumstances that line up like that, try updating the cloudwatch log agent.🤷
05/04/2020, 11:35 PM
Thanks for the comment, I'll check it out
05/11/2020, 11:47 PM
Hey @nyanshak this presentation specifically calles out the profile.py script to profile queries but that is not functional for Windows. Do you know a good alternative?
05/12/2020, 2:14 PM
I'm not super familiar with Windows-specific osquery issues. Would probably do better to post a question about profiling to #general or #windows. Maybe include why it's "not functional for Windows" 😕
05/20/2020, 2:59 PM
It is just execution errors.
05/20/2020, 4:10 PM
What ^ does that mean? Did you manage to get profile.py working on Windows?
06/01/2020, 3:09 AM
no, it means when you run profile.py on windows it throws errors during execution