Channels
- t
TheHellaJeff
2 years agoHas anyone ever needed to/explored changing the niceness of osquery? I found this issue (https://github.com/osquery/osquery/issues/516) from a few years back talking about the idea of using it, would there be any merits/negatives to attempting this? 
theopolis
2 years agoThis happens already when a watchdog is used (the default) https://github.com/osquery/osquery/blob/2f681e7bdca8f9bb1fb8f6ce4708df7c1fc132c9/osquery/process/posix/process_ops.cpp#L58
Its a static priority of 10, would you want to configure it to another value? I've been successful controlling usage through cgroups vs. relying on osquery to control itself (even though it tries hard).- t
TheHellaJeff
2 years agoIt’s just a small number of OSX workstations are having some problems with the subprocess eating up large amounts of system resources when we have process auditing enabled, I’m not sure where else to go in trying to address this - s
seph
2 years agoDo you need to ingest that many events? What are you doing with them?
View count: 1