https://github.com/osquery/osquery logo
#eclecticiq-polylogyx-extension
Title
# eclecticiq-polylogyx-extension
m

Michael

02/18/2021, 10:07 AM
Hi, community! I have a problem here, could you please advice? We have Control server with Polylogyx Community edition and a test workstation with Polylogyx agent installed through plgx_cpt. We tried to test agent removeal and re-registration and do the following: • remove agent from Hosts on Control server • remove agent on workstation using
plgx_cpt -u d
• install agent again as it should be - with a certificate and Control server IP, all works well • now agent is working nice, but it doesn't appear on the Control server We tried to reinstall agent, reboot both workstation and Control server and upgrade the agent using
plgx_cpt -g d
. Could be this problem solved somehow?
k

Kishore Arava

02/18/2021, 10:23 AM
Hi @Michael, There is an option in the Control Server UI, to re-enable the host agent and problem can be solved. Please re-enable it from Management --> Removed Hosts page and check the agent status in Hosts page. If the issue still exists, then please reinstall the agent after enabling the host in Management --> Removed Hosts page. (PolyLogyx-ESP may restrict the agent enrollment for the removed host until it gets enabled)
m

Michael

02/18/2021, 10:25 AM
Hi, @Kishore Arava, thank you for the reply! We remove agent from Removed hosts before reinstalling it
m

moulik

02/18/2021, 10:30 AM
Currently, the deleted can be enrolled after the purge duration is over(default is 7 days) Can you run this query to make the host active
update node set state=0 where id=<removed_host_id>;
m

Michael

02/18/2021, 10:48 AM
Sure. And what is `<removed_host_id>' ?
Is it agent name?
m

moulik

02/18/2021, 1:16 PM
removed host is the unique
id
of the host.You can list the nodes and see which node was deleted
select * from node;
and grab the
id
column for the deleted host
👍 1
m

Michael

02/18/2021, 2:31 PM
It works, thanks a lot!
I have another question if you don't mind: is there a way to change already registered agent hostname not using SQL?
m

moulik

02/19/2021, 6:14 AM
No There is no feature for this System name is taken from the osquery table
m

Michael

02/19/2021, 7:19 AM
Hm, okay, thanks!
9 Views