Lucas Manuel Rodriguez
34af79e98a
Resolves #47894 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually --- Performance results on my macOS host (between the old an new query): Clean, dramatic result. Subtracting the ~0.23 s / ~27.5 MB osqueryd startup baseline to isolate the query cost: ``` ┌─────────────────────┬───────────┬──────────┬──────────────────────────┐ │ │ Wall time │ Peak RSS │ Query-attributable work¹ │ ├─────────────────────┼───────────┼──────────┼──────────────────────────┤ │ Baseline (SELECT 1) │ 0.23 s │ 27.5 MB │ — │ ├─────────────────────┼───────────┼──────────┼──────────────────────────┤ │ OLD (recursive %%) │ ~1.46 s │ 128 MB │ +1.23 s, +100 MB │ ├─────────────────────┼───────────┼──────────┼──────────────────────────┤ │ NEW (bounded 2+3) │ 0.24 s │ 27.8 MB │ +0.01 s, +0.3 MB │ └─────────────────────┴───────────┴──────────┴──────────────────────────┘ ¹ over baseline ``` Takeaways: - Memory: ~128 MB → ~28 MB peak (–100 MB). The recursive walk alone added ~100 MB; the bounded version adds essentially nothing. - Time: ~1.46 s → ~0.24 s (~6× faster wall clock; the query-attributable work dropped ~1.23 s → ~0.01 s, effectively free). - System time tells the story: OLD spends 0.88–0.97 s in sys (the readdir/stat syscalls from walking the tree); NEW spends ~0.00 s. And this is with only 6 casks, dominated by gcloud-cli's ~98k-entry SDK tree (walked twice via the latest → version symlink, plus following the app back-symlinks into /Applications bundles). The recursive query hit 128 MB peak from a single well-stocked host — already within striking distance of osquery's 200 MB watchdog limit. On hosts with more or larger casks (or the /Library//Applications patterns from the issue), that's exactly what tips it over and kills the worker. The bounded version is flat regardless.
Fleet documentation
Welcome to the documentation for Fleet, the lightweight management platform for laptops and servers.
You can also read the Fleet docs over at https://fleetdm.com/docs.
Using Fleet
Resources for using the Fleet UI, fleetctl CLI, and Fleet REST API.
Deploying
Resources for installing Fleet's infrastructure dependencies, configuring Fleet, deploying osquery to hosts, and viewing example deployment scenarios.
Contributing
If you're interested in interacting with the Fleet source code, you'll find information on modifying and building the code here.
If you have any questions, please don't hesitate to File a GitHub issue or join us on Slack. You can find us in the #fleet channel.