search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
2.92k stars 405 forks source link

Customize query report cap in the UI #15693

Open rachaelshaw opened 8 months ago

rachaelshaw commented 8 months ago

Goal

User story
As a Fleet admin,
I want to customize the query report result cap via the Fleet UI
so that I can see the options that are recommended.

Context

Changes

Product

Engineering

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

Manual testing steps

  1. Step 1
  2. Step 2
  3. Step 3

Testing notes

Confirmation

  1. [ ] Engineer (@____): Added comment to user story confirming successful completion of QA.
  2. [ ] QA (@____): Added comment to user story confirming successful completion of QA.
noahtalerman commented 7 months ago

Heads up @rachaelshaw this request was discussed during feature fest last week and didn't make it into the current design sprint.

ksatter commented 4 months ago

@nonpunctual I'm adding your tag to this as it has come up again. Feel free to remove.

rachaelshaw commented 3 months ago

Almost ready to call this settled. One more thing we'd like to get feedback on is how we handle existing reports when the query report cap is adjusted.

The ideal way would be to only delete results from reports that don't fit with the updated cap: Screenshot 2024-05-16 at 11 36 06 AM

A simpler way would be to just delete all query results if the setting is changed: Screenshot 2024-05-16 at 11 36 17 AM

@mostlikelee since you worked on the original feature, do you think you could give a rough idea of how much work it would be to handle this edge case the nicer way vs. the deleting-everything way? Here's the Figma for more context (happy to answer any questions at standup if any of this isn't clear)

nonpunctual commented 3 months ago

related: https://github.com/fleetdm/fleet/issues/7766 https://github.com/fleetdm/fleet/issues/15381 https://github.com/fleetdm/fleet/issues/11492

sharon-fdm commented 3 months ago

BE: 8 FE: 2-3

noahtalerman commented 3 months ago

Hey @rachaelshaw, are the TODOs in the product section still TODOs?

Also, which version did we end up estimating? The original version or alternate version.

rachaelshaw commented 3 months ago

Hey @rachaelshaw, are the TODOs in the product section still TODOs?

Just the REST API (configuration endpoints); updated the description. (I can make a draft PR as well once the changes to the modify configuration formatting are merged in)

Also, which version did we end up estimating? The original version or alternate version.

@noahtalerman I think the original version, although we kind of glossed over that in estimation— got the impression that part of it didn't have a huge impact on the estimate. Think I should move it to scratchpad, or leave it in case it does end up making a difference?

rachaelshaw commented 2 months ago

The query report cap was divided into 2 separate issues: this one for the UI and #19600 for the config (which will ship first).

noahtalerman commented 2 months ago

FYI @mostlikelee and @rachaelshaw, I moved our convo from design review below for safekeeping.

Noah: Query reports solve the live query on all hosts problem. Noah: Something new for custom columns on the Hosts page. New kind of query.

Tim: When you send a query to all hosts and they’re all online then the UI freezes up for a couple minutes Tim: This gets compounded when you save multiple queries in quick succession Tim: osquery perf might not act like real-life osquery works. Osquery might spread out queries on a specific host

Noah: What about the Fleet server?

Tim: We could do extra work to spread out the results

Noah: So we could sink a bunch of time into improving the Fleet database and spreading out processing and doing testing with real osquery and still not get to 100,000 results.

Tim: Using Elastic Search works 50,000k hosts and 30 queries (1 hr interval). Each query returns one result. One query that returns 10 results per host.

Noah: Ignoring the cost, sounds great for managed cloud

Tim: Could be a paid feature? Tim: Would be helpful to come up with frequency and number of queries to help narrow scope and cost analysis.

Noah: Start with 100 queries running every hour Noah: Have a minimum value for queries with reports? Noah: Have a max number of queries with reports on? Noah: Is Jamf every 24 hrs? Ask Brock

Tim: MySQL will be less performant for custom queries Tim: Extension attributes have to return a single string.

rachaelshaw commented 1 month ago

This didn't get designed within the 3-week drafting timeline, bringing back to Feature Fest