Channels
  • Daisukixci

    Daisukixci

    1 year ago
    đź‘‹ one of our user have an issue with performance spike and a recurrent log
    Jun 22 12:35:33 xxxxxxx osqueryd[198]: osqueryd worker (82507) stopping: Memory limits exceeded: 222240768
    I may have determined that this is linked to his bash history (
    SELECT * from users JOIN shell_history using (uid);
    ) because when we move it somewhere else and create a new one, the log doesn’t appear again. His history is 4.5MB, I don’t know if it’s too big (guess not but saying it just in case). Any thing we try to do to find the root cause without deleting his all history ?
  • theopolis

    theopolis

    1 year ago
    Hi @Daisukixci, I looked into this and I think I have a solution for the memory impact of
    shell_history
    . https://github.com/osquery/osquery/pull/6541
  • Daisukixci

    Daisukixci

    1 year ago
    Hi, Thanks, gonna test it and provide feedback.