fleet
fleet copied to clipboard
Limit number of hosts that can be queried in ad-hoc querying
I'd like to be able to restrict the max # of hosts that can be queried in the ad-hoc querying panel, as users trying to query All Hosts causes greatly increased load on fleet cpu instances and the database.
I think a suitable short-term solution would be to be able to set limits on the max number of hosts that can be queried at once on the ad-hoc querying panel, such as "only 1 host", up to N hosts, etc.
A better long-term solution is much more difficult (and probably scoped for another ticket), but I think might look something like this:
- use "campaign id" and return a link to the scheduled job to the user
- as hosts report in, save results in redis
- when user loads the campaign results page, paginate results (instead of trying to return all results live, and in one browser window)
- allow user to cancel campaign (and thus stop telling hosts to send results back)
- mark hosts timed out if they don't return results in
The current ad-hoc querying system is too resource-intensive for the fleet compute instances, for the database, and for my browser (loading so many results at once).