Monitor performance for queries that don't have automations enabled

[mikermcneil]

User story
As a Fleet user,
I want to see the performance impact any of my queries (not just those that have been automated),
so that I don't see the word "Undetermined" over and over again in the UI where I'm expecting query performance to exist, and so that i don't have to be using Splunk etc. to be able to see the promised query performance feature.

✅ Monitor performance for queries

Why do I want it? Because I'm worried about end user experience on my hosts and I want to know whether it's safe to run given queries across wider sections of my Fleet. Also, if there are performance isues reported by end users, this way I can find and correct queries that might be causing those issues.

• In the UI, where relevant, show the live query performance impact.
• UPDATE: Bring back adding the performance impact in the activity feed. Just show this for saved queries.

Related

• Preceded by: osquery tracks live query performance #8881

Changes

This issue's estimation includes completing:

• UI changes: Figma
  • Update activities
    • Update copy to conditionally include performance impact
    • Conditionally add performance impact + tooltip to show query modal
  • Queries page
    • Update tooltip for "Performance impact" column
    • Update tooltip for "Undetermined" cells in Performance impact column
  • Host details > Queries tab: Update tooltip for "Undetermined" cells in Performance impact column
• REST API changes: Draft PR
• Database schema migrations: TODO

QA Test Plan

• Load testing required -- save a query and run it as a live query during load test. (Load test agents now send back stats.)

Manual Steps

• Have an existing scheduled query that shows up in Host Details Schedule with stats. Restart the host. Refresh host details after it comes back up. The stats should still be there -- they should not have been cleared.
• Create a scheduled query with automations. Run it as a live query. The Queries page should now have stats for that query. The Host Details Schedule page should now have stats for that query (for host(s) that ran the query). The Query edit page should now have stats for that query (see Figma). The activity feed should be updated with stats after query finishes running.
  • Repeat this step running live query with fleetctl and running live query with REST API.
• Delete 1 query with stats.
• Delete multiple queries with stats.

[mikermcneil]

This is an enhancement to #463

[noahtalerman]

Below is the live query portion of the API wireframe to support the activity feed on the Home page in the Fleet UI.

Check out this comment in the "Audit live queries and other activity" issue for the entire response of the API wireframe: #463 (comment)

GET /api/fleet/activity?page=0&per_page=10

{ 
  "activities": [
    ...
    {
      "id": 9,
      "created_at": "2020-11-05T05:09:44Z",
      "actor_full_name": "Jane Doe",
      "actor_id": 1,
      "type": "live_query",
      "details": {
        "targets_count": 12030,
        "duration_ms": 1232323
      }
    }
  ]
}

[zayhanlon]

@zhumo The osquery table returns the performance impact AFTER the query is run. Is this still helpful to bring into Fleet UI?