The osquery Agent. Performance Tuning @Scale
summary
osquery includes a watchdog that limits a worker to 10% CPU for 12s and 200MB RAM (configurable to 5%/6s/100MB or disabled) and blacklists offending queries for 24 hours, preventing crash loops. Performance data lands in the schedule table as cumulative wall/user/system times (seconds vs milliseconds) and average memory, which feeds dashboards. Safe rollout uses host segmentation plus shard rollout percentages, a local profiling script for per-host baselines, and sqlite query inspection to find costly joins or duplicate table hits.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:17osquery update
- 5:45watchdog
- 13:45monitoring
- 20:05deployment strategies
- 24:23debugging
related talks
37mPerformance Diagnostics with Open Distro for Elasticsearch
40mBeyond Endpoint Security Using Osquery at Scale
20mUnified Performance Observability in OpenSearch: Integrating Workload Management and Query Insights
22mIntrospecting your machines with osquery
20mLeveraging Osquery for DFIR at Scale
29mWho Watches the Watchers? From Closed Observability To...
38mMonitoring 101
17mMastering the Query Insights Dashboard in OpenSearch