https://github.com/osquery/osquery logo
#general
Title
# general
m

mishaky

03/03/2020, 7:03 PM
Hi all! I have a question on sharding (restricting the query to a percentage of the target hosts). Does sharding pick the same hosts every time? For example, if we shard to %15 of hosts, can we expect the same hosts to be chosen every time the query runs?
z

zwass

03/03/2020, 7:08 PM
Typically yes. The shard is determined by a hash of the hostname. https://github.com/osquery/osquery/blob/master/osquery/config/packs.cpp#L66-L86
m

mishaky

03/04/2020, 5:40 PM
Thanks Zach!