Allow disabling vulnerabilities processing but keeping software inventory

[getvictor]

• customer-preston: Gong snippet: https://us-65885.app.gong.io/call?id=9055749605989713649&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A577%2C%22to%22%3A614%7D%5D
• @noahtalerman: User requested this because they want to see all software that's installed across all their hosts on the Software page. Currently, they only see software that's available for install because they disabled the vulnerabilities scheduled job. Currently, this job maps software to vulnerabilities and aggregates software data across hosts. So, if one turns off the job, they won't get vulnerabilities and they will only see software available for install on the Software page. Preston hosts one Fleet instance for each of their customers. They want to save money on compute costs. One way they found that they could save money is by disabling the vulnerability processing job. "It would be a couple extra $10k a year."
  • @noahtalerman: Eventually Fleet could add a new configuration option to enable/disable software aggregation (decouple from vulnerability job). Preston would enable this and keep vulnerability processing disabled.
    • @noahtalerman: If Fleet does this, how much does it cost to do software aggregation without vulnerability processing? Maybe software aggregation is the most memory intensive.
      • @harrisonravazzolo: We could use a test instance to roughly understand the cost. @noahtalerman: We could also use dogfood.

---

[noahtalerman]

Currently, disabling the vulnerabilities job means that no software shows up on the Software page. In addition, software and software_titles are not cleaned up from DB if they are no longer installed on any hosts. The cleanup only happens during the vulnerabilities job.

Hey @getvictor do we document this current behavior?

[getvictor]

Currently, disabling the vulnerabilities job means that no software shows up on the Software page. In addition, software and software_titles are not cleaned up from DB if they are no longer installed on any hosts. The cleanup only happens during the vulnerabilities job.

Hey @getvictor do we document this current behavior?

I don't think so. Most customers run the vulnerability job, so this is not an issue for most.

[noahtalerman]

Goal

User story
As an IT admin,
I want to disable (or scale back) the vulnerabilities job but keep the software inventory
so that I can optimize my compute resources.

Context

Currently, disabling the vulnerabilities job means that no software shows up on the Software page. In addition, software and software_titles are not cleaned up from DB if they are no longer installed on any hosts. The cleanup only happens during the vulnerabilities job.

We should have separate enables (and periodicities) for vulnerabilities and software inventory jobs.

[noahtalerman]

@pintomi1989 can you please add a Gong snippet from preston? We want a Gong snippet before we can prioritize this one (I just realized we're missing one).

[pintomi1989]

Hey @noahtalerman - Here's the clip for customer-preston: https://us-65885.app.gong.io/call?id=9055749605989713649&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A604%2C%22to%22%3A641%7D%5D