is there any timeout to fleet when I run a query that takes a long time to return reaults?

This is controlled by

FLEET_LIVE_QUERY_REST_PERIOD

. Bear with me while I get some clarification from the team on the ins and outs of that.

how can I change this?

You can set a different value for that setting in your Fleet configuration.

The fixed time period is configurable via environment variable on the Fleet server (eg.

FLEET_LIVE_QUERY_REST_PERIOD=90s

). If setting a higher value, be sure that you do not exceed your load balancer timeout.

> WARNING: This API endpoint collects responses in-memory (RAM) on the Fleet compute instance handling this request, which can overflow if the result set is large enough. This has the potential to crash the process and/or cause an autoscaling event in your cloud provider, depending on how Fleet is deployed.

https://fleetdm.com/docs/using-fleet/rest-api#run-live-query

ok thanks

If you're using a load balancer, you may have a limit set on how long a connection is allowed to stay open. Make sure that the rest period is shorter than that timeout.

https://osquery.slack.com/archives/C01DXJL16D8/p1674241889675149?thread_ts=1673990590.837659&cid=C01DXJL16D8 where do I change the fleet configuration?

You can set that using whichever method you're currently using to set. your Fleet configuration. As an environmental variable:

FLEET_LIVE_QUERY_REST_PERIOD=90s

As a command line flag:

/usr/bin/fleet serve \
--mysql_address=127.0.0.1:3306 \
--mysql_database=fleet \
--mysql_username=root \
--mysql_password=toor \
--redis_address=127.0.0.1:6379 \
--server_cert=/tmp/server.cert \
--server_key=/tmp/server.key \
--logging_json
--live_query_rest_period=90s

or in a

.yaml

config file:

echo '

mysql:
  address: 127.0.0.1:3306
  database: fleet
  username: root
  password: toor
redis:
  address: 127.0.0.1:6379
server:
  cert: /tmp/server.cert
  key: /tmp/server.key
logging:
  json: true
live_query_rest_period: 90s
' > /tmp/fleet.yml


fleet serve --config /tmp/fleet.yml

yes, because I created new table than scans all the process and every scan takes like 2 min

I'm sorry, but I don't understand your question. Can you please try to explain more?

@zwass when I run fleet command it describe many fleet environment variables that I can give for example

FLEET_MYSQL_ADDRESS

but I don't see the varrible FLEET_LIVE_QUERY_REST_PERIOD=90s

Thanks for bringing that up! it appears that

FLEET_LIVE_QUERY_REST_PERIOD

is a bit of a special case and can currently only be set as an environmental variable. So sorry about the confusion! I'm submitting a ticket now to get that more in line with the other configuration options. For now, you can set it using the environment.

@Kathy Satterlee thanks for the ticket!

You can set the rest period as an environmental variable where Fleet is run. The exact method for that will depend on how you're deploying Fleet.

@Kathy Satterlee I deployed it by k8s