search

google / grr

GRR Rapid Response: remote live forensics for incident response
https://grr-doc.readthedocs.io/
Apache License 2.0
4.75k stars 762 forks source link

Cron periodicity doesn't work #608

Open cyb3rn1n1 opened 6 years ago

cyb3rn1n1 commented 6 years ago

Hi ! Cron periodicity is not working properly on my GRR Server. I launched crons with 5s and 1m periodicity but in both cases, hunts are created every 5 minutes instead of 5 seconds or 1 minute.

image

image

image

Does anyone know why ?

grrrrrrrrr commented 6 years ago

Hey,

This is somewhat working as intended. We have a thread in each worker that checks every 5 minutes if cronjobs need to be run (https://github.com/google/grr/blob/master/grr/server/grr_response_server/aff4_objects/cronjobs.py#L319). If you only run a single worker, your cron jobs can't run with a periodicity of less than 5 minutes.

Now, you could change that time in the code to check more frequently but I'm not convinced that it's a good idea. GRR is a response tool and is optimized for that use case. If you want continuous monitoring, you are most likely better off using a dedicated tool for that compared to running a GRR flow every 5 seconds.

Can you provide some more context about what you want to do? Maybe there is a better way somehow...

Cheers, -Andy

cyb3rn1n1 commented 6 years ago

Hi Andy, thank you for your reply. I'll try this way and see if it works.

Yes exactly, I would like to do continuous monitoring and I thought GRR was able to do that. What do you think ?