https://github.com/osquery/osquery logo
#fleet
Title
# fleet
m

MarkMurdock

07/05/2021, 6:26 PM
After upgrading to Fleetdm 4.0.1 it appears that my hosts are logging with the uuid identifier despite my options indicating it should be the hostname:
Copy code
agent_options:
    config:
      decorators:
        load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT hostname AS hostname FROM system_info;
      options:
        config_tls_max_attempts: 10
        disable_distributed: false
        distributed_interval: 10
        distributed_plugin: tls
        distributed_tls_max_attempts: 10
        host_identifier: hostname
        logger_plugin: tls
        logger_tls_endpoint: /api/v1/osquery/log
        logger_tls_period: 10
        pack_delimiter: /
    overrides:
      platforms:
        windows:
          options:
            enable_powershell_events_subscriber: true
            enable_windows_events_publisher: true
            enable_windows_events_subscriber: true
r

Rachel Perkins

07/05/2021, 7:16 PM
Hmm... Can you run osquery with
--verbose --tls_dump
and look at whether Fleet is returning the appropriate configuration?
m

MarkMurdock

07/06/2021, 6:11 PM
I'm sorry, I just sorted this out and it has nothing to do with my Fleet upgrade. I was not properly rotating my result.log and was looking at some old data. Ignore this and enjoy more important (and real) problems!