https://github.com/osquery/osquery logo
#fleet
Title
# fleet
j

jlk

01/19/2022, 2:15 AM
Hey peeps - I'm trying to run a "simple" query (
SELECT * FROM system_info
) against a single host via API, but it's timing out (
504 Gateway Time-out
) I can call the same saved query from the fleetdm web ui and it works in a few seconds. This is a fresh fleet install - sound like a familiar problem to anyone?
z

zwass

01/19/2022, 2:20 AM
Using this API? https://fleetdm.com/docs/using-fleet/rest-api#run-live-query Perhaps the issue is that it waits 90 seconds before returning results. I wonder if we should try to make it return early if all "expected" hosts have responded.
j

jlk

01/19/2022, 2:22 AM
yes
z

zwass

01/19/2022, 2:32 AM
Probably need to extend the timeout on your load balancer. Or you can use the websockets API, but it's a fair bit more complex. We'll look into making this configurable and/or returning early if all results are back.
Oh, actually, looks like we made it configurable via env var on the Fleet server: https://github.com/fleetdm/fleet/blob/69a4985cacd3724a46fc917220cae0433b2f04d6/server/service/live_queries.go#L39 You should be able to set it via
FLEET_LIVE_QUERY_REST_PERIOD=20s
.
j

jlk

01/19/2022, 2:36 AM
is the web ui using websockets?
z

zwass

01/19/2022, 2:36 AM
Yes
j

jlk

01/19/2022, 2:38 AM
ah, hm. Any idea why it'd take long enough to timeout when I run the query via REST? (webui completes in 5 seconds)
z

zwass

01/19/2022, 2:40 AM
Yes, because the "simple" API always waits a fixed amount of time for results before returning, while the websocket API streams results as they come in.
j

jlk

01/19/2022, 2:45 AM
ok, got it thx
3 Views