Invoke-FalconRTR hangs when executing on large number of workstations (99+).

[dumpmycode]

Description of your question
Script from github (upload & execute local script as secondary process) hangs and exits when targeting 99+hosts. Usually from operator POV, we will see execution report.

Am i not doing this correctly or Invoke-FalconRtr should only be used for a handful of workstations?

https://github.com/CrowdStrike/psfalcon/blob/master/samples/real-time_response/upload-and-execute-a-local-script-as-a-secondary-process.ps1

To Reproduce

PS C:\temp> $workstations = Get-FalconHostGroupMember -Id $(Get-FalconHostGroup -Filter "name:'workstations'") -All
PS C:\temp> RunRTR-InlineScript -ScriptPath "C:\temp\looptest.ps1" -HostId $workstations[0..99]

Expected behavior
looptest.ps1 executed on all 100 workstations with offline queuing when workstation state is offline

Environment (please complete the following information):

• OS:Windows 10
• PowerShell v5.1
• PSFalcon v2.2.5

Additional context
Script taken from github page with slight modification to offlinequeueing & verbosity.

function RunRTR-InlineScript{
    <# https://github.com/CrowdStrike/psfalcon/blob/master/samples/real-time_response/upload-and-execute-a-local-script-as-a-
    #>
        [CmdletBinding()]
        param(
          [Parameter(Mandatory,Position=1)]
          [ValidateScript({ Test-Path $_ })]
          [string]$ScriptPath,
          [Parameter(Mandatory,Position=2)]
          [ValidatePattern('^[a-fA-F0-9]{32}$')]
          [string[]]$HostId
        )

        $EncodedScript = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes((Get-Content -Path $ScriptPath -Raw)))
        $Param = @{
            Command = 'runscript'
            Argument = '-Raw=```Start-Process -FilePath powershell.exe -ArgumentList "-Enc ' + $EncodedScript + '"```'
            HostId = $HostId
            QueueOffline = $true
            Verbose = $true
        }
        Invoke-FalconRtr @Param
    }

looptest.ps1

#looptest
$a = 0
while($a -lt 30){
	sleep 1
	$a += 1
}

output

PS C:\temp> $workstations = Get-FalconHostGroupMember -Id $(Get-FalconHostGroup -Filter "name:'workstations'") -All
PS C:\temp> RunRTR-InlineScript -ScriptPath "C:\temp\looptest.ps1" -HostId $workstations[0..99]

VERBOSE: 17:11:59 [Request-FalconToken] Authorized until: 01/18/2024 17:41:58
VERBOSE: 17:11:59 [Start-FalconSession] /real-time-response/combined/batch-init-session/v1:post
VERBOSE: 17:11:59 [ApiClient.Invoke] POST https://api.crowdstrike.com/real-time-response/combined/batch-init-session/v1?timeout=600
VERBOSE: 17:11:59 [ApiClient.Invoke] ContentType=application/json, Accept=application/json
VERBOSE: 17:11:59 [ApiClient.Invoke] {"queue_offline":true,"host_ids":["id1","id2",...<snip>...,"id100"]}}
<hangs for 4-5mins>.. then back to PS prompt with no usual status report.
PS C:\temp> 

[bk-cs]

Can you update to version 2.2.6? This was a known issue that should be resolved (#351).

[dumpmycode]

That worked thanks Brendan!

Sorry for that! tried to look for similar issues but didnt come up with anything which must be from using incorrect search terms.

[dako76]

Hello, @bk-cs can you tell me what is the max. number of hosts in the array i can use with this command? For example if i have 5000 Hosts where i whant to execute a script. Because for example i get this error:

Write-Result : {"code":40010,"message":"unable to initialize session, reach out to support with this information: cloud_request_id: xxx"}
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\private\Private.ps1:663 char:9
+         Write-Result $Object
+         ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (@{resources=Sys...ystem.Object[]}:PSObject) [Write-Result], Exception
    + FullyQualifiedErrorId : Write-Result

[bk-cs]

There is not a max for use with this command--it will automatically create individual sessions of 10,000 hosts as necessary. If there's an error being produced, it might be because the related API is having a problem. I recommend opening a support ticket with the provided cloud_request_id for further troubleshooting.