3 ms·
The senior sysadmins neglected to configure osquery’s client performance safeguards and apply properly scoped access (observer mode!) on the server. Systems ad
by w0de0 3y ago
The senior sysadmins neglected to configure osquery’s client performance safeguards and apply properly scoped access (observer mode!) on the server.
Systems administration is the art of protecting everyone with less access from footguns while still and especially enabling their use of effective tools.
First-person testimony.
- mikermcneil 3y agoFeel your pain! This was the idea behind query performance "bubbles" in Fleet. (Uses the osquery performance metadata to indicate whether performance impact of a query on a host is "minimal", "considerable", or "excessive") Next step is "clairvoyance", where we predict perf based on the SQL when you're in the query editor