How often do labels refresh? Is the refresh frequency configurable?

[fleetdm]

How often do labels refresh? Is the refresh frequency configurable?

[noahtalerman]

Hi @asterisk800. Ah ok. I'm now assuming that when you use the words "labels' data" you're referring to entries in the MySQL database that have to do with labels. I could be wrong in this assumption so please correct me if I am.

I don't know the exact refresh frequency and if this frequency is configurable. I'm working on getting you an answer to this now.

I'm not sure if you've already seen #49. In the coming months, we're currently hoping to publish more detailed results of stress testing as well as information about real production deployments. Please let us know in this issue, or reach out privately, if you have any real-world data to share.

[zwass]

@asterisk800 When selecting a label in the UI, a request is made to the Fleet server to get the membership of the label. There is no further action needed with the osquery clients as this data is already maintained by the Fleet server.

The update frequency for labels is configurable with the --osquery_label_update_interval flag (default 1 hour). I would not expect to see any significant performance impacts for 10 labels.

Have you observed something that causes concern? Does this answer your question?

[noahtalerman]

Hi! Great question. I'm assuming you're creating labels using the Fleet UI. When you use the word "refresh" are you referring to the request that's made to the Fleet server when you select one of your labels in the UI? This request returns an object with matching hosts and their respective information.

[asterisk800]

Hi @noahtalerman, yes, I am referring to labels in the Fleet UI. When it comes to updating the labels' data, are requests only made to the Fleet server when selecting a label in the UI?

[asterisk800]

@noahtalerman, thank you for the info!
@zwass, thank you for sharing the osquery_label_update_interval flag; that was what I was looking for.
I am not currently seeing any performance issues. But I was planning to add more labels, and now I have the flag and the default value, I have a better understanding of how labels may impact performance.