OsQuery high consumption memory

Elastic Stack Beats
,
1

We are trying in production for the first time and in many server, we deployed it in 40 servers and we saw that OsQuery use up to 1.4gb of memory. I couldn´t find any information or workarround or even if it is normal consumption, look at this graph..

memoria
memoria529×352 12 KB

2

I found out what was going on with this specific query. Apparently, if the query brings in too much data, there’s some kind of leak. So, I have to tweak the logic to limit the data returned by the query

3

Would you be able to share the specific query you were having issues with so that if someone runs into this problem in the future they can more easily find the solution?

4

this was the query if i don´t remember wrong

SELECT eventid,data
FROM windows_eventlog 
WHERE channel= "Microsoft-Windows-WindowsUpdateClient/Operational" 
AND eventid = 26
limit 1

which was bringing too much data so the osquery cache was never released, i dont know why.

so i changed it for this one

SELECT eventid, json_extract(data, '$.EventData.updateCount') AS updateCount 
FROM windows_eventlog 
WHERE channel = 'Microsoft-Windows-WindowsUpdateClient/Operational' AND eventid = 26 
AND datetime >= strftime('%s', 'now', '-1 day') 
ORDER BY timestamp DESC 
LIMIT 1;