https://github.com/osquery/osquery logo
Title
m

Marc Roelofs

03/09/2023, 2:49 PM
Hi, if I'd like to run a fleet instance as only a web gui , and another for the osquery clients to talk to. How would I handle the scheduled query and the output to the designated log directory . As both instances will run the scheduled query, write output (thus duplicate every query output), and that output I'm picking up and forwarding to an ES instance , Seems silly to have it 2x 😉 .
r

roberto

03/09/2023, 8:18 PM
hey, I'll need to know more details about your infra to properly answer that. what I can tell you, we have seen two approaches for the kind of separation you want to do: 1. Use a load balancer to direct traffic to each fleet instance: https://fleetdm.com/docs/deploying/reference-architectures 2. https://defensivedepth.com/2020/04/02/kolide-fleet-breaking-out-the-osquery-api-web-ui/ lmk if I didn't understand your question!
b

Benjamin Edwards

03/10/2023, 5:54 AM
Marc the hosts connected to fleet periodically check in and "pull" down their schedules, and thus will only be run once.
m

Marc Roelofs

04/03/2023, 6:36 AM
Thank you for your replies , I'll do a deeper dive soon !