hey everyone, I want to write a query on windows device that can show me the percentage of processes in CPU , dose someone have any query to recommend on?

"*W0615 145154.236747 3402 tls.cpp:101] Cannot read TLS server certificate(s): /etc/osquery/fleet.crt* E0615 145154.243299 3402 shutdown.cpp:69] Cannot activate tls logger plugin: No node key, TLS logging disabled." Hello team how do i go about these

Hi, my name is Silvano and i have a quick question regarding setting up FleetDm. I have been trying to add the hosts in vain and it appears like its an issue with the self-signed certificate. I'd appreciate if someone could guide me on how to enroll hosts to FleetDM Error,

I0615 15:16:19.983693 17433 tls.cpp:255] TLS/HTTPS POST request to URI: <https://172.27.63.225:8412/api/v1/osquery/enroll>
W0615 15:16:20.030148 17433 tls_enroll.cpp:77] Failed enrollment request to <https://172.27.63.225:8412/api/v1/osquery/enroll> (Request error: certificate verify failed) retrying...

Hey all. Is it possible to create an osx or windows orbit package from a Linux fleet deployment? I k ow windows requires docker, but trying to create type "pkg" gives an exec error and never finishes

Howdy Gang, Anyway to make these default/persistent? Every time I log in, I have to pick my preferences again.

Analyzing our fleetdm status events at Splunk, we just noticed that software inventory queries are not working fine since osqueryd running as "admin/root" needs

consider JOINing against the users table

Fleet v. 3.12.1 When I navigate to Queries --> Create New Queries And then I try to select a host to run the query against, the

Select Targets

is never filled with the host I am selecting.... Tried it on FF & Chrome, same issue. May be related / fixed with this? https://github.com/fleetdm/fleet/issues/993

i rolled out osquery to some immutable hosts in gcp, i found that i’m getting only 1 machine in fleet, i did run osqueryd with options

/usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --verbose --tls_dump

i noticed that they have the same node_key, and UUID, what would be the solution for this ?

Hey, hope you are all well. I am a new bebbie in #fleet I will appreciate it if someone could share a blog post explaining how to run scheduled queries against all end points and access the json results on the server running Fleet. My goal is to ship the logs to ElasticSearch via Logstash I don't seem to find a detailed post regarding this.

Yea so now wierdly it works from the cmd prompt but not when ran as a windows service

Is there a way to group hosts?

Is there a specific PPPC profile I need for fleet that is different from osqueryd?

WUT??????? Those paths are obviously false and the agregating logs link just takes you to osquery doco. Where is fleet storing query results?

Does osquery either report to fleet OR write to a local log or can it do both?

@Silvano Ngacha I'm currently pulling Security log so perhaps I can help you do the same with Application log?

Hi there, I am trying to setup a demo security onion solution as a proof concept for my workplace and have managed to connect a machine running RHEL without any issues but when running the MSI launcher on a Windows Server 2016 instance it just doesn't seem to add it to the fleet at all? Has anyone else ran into issues trying to add a 2016 Windows Server machine to the fleet using just the launcher provided by SO?

Hi There, while doing some license analysis with blackduck tool, we saw this enterprise edition content in the ee directory. Knocking out that feature content should imply that the binary is back to the original MIT license? Is my understanding here correct?

What is a "shard" in query packs?

Hey folks. We're currently running fleet in our environment in a horizontally scaled setup - multiple fleet servers sharing one db and redis store. On two of our fleet servers the devices that are showing as "offline" are actually showing as online in other fleet servers. the hosts/devices are indeed up when I check the osquery communication with their respective fleet server. We are not running this setup loadbalanced, rather every DC has one fleet server that serves as the TLS server for osquery agents within that DC. Any ideas what could be the problem? Here's what I have checked so far: 1. increased maximum connections support on the db and fleet servers 2.

--verbose

--tls_dump

flags with osquery agents shows that the connection is stable and the agents are able to communicate properly 3. the db is working fine and is reflecting latest

last_seen_time

in the hosts table 4. packet capture shows consistent data exchange between mysql server and the affected fleetdm servers.

I can make an issue if anyone thinks this is worth addressing. I was trying to curl the fleet API with an old/invalid token, but was getting back

Authentication required

. Maybe api requests with an

Authorization: Bearer

header, but fail authentication should get back a different error saying invalid credentials. I'm guessing most people would double check their api token after getting the current response though.

When I go to the root https://github.com/fleetdm/fleet/tree/main/docs I can see that it should be 3-Deployment not 2-Deploying that is why

Hello, is it possible to discriminate based on osquery host for config, just like how we can discriminate based on platform type?

🏗️ New commits pushed to Fleet: - noahtalerman: Update notification message for inviting users and update notification styles... - gillespi314: Remove unused image file (#1201) - RachelElysia: Replace invitedbyusername with invitedby (#1200) - noahtalerman: Add usage statistics documentation to Using-Fleet section (#1196) - RachelElysia: Remove username from UI (#1168) - gillespi314: Update email templates (#1175) - zwass: Fix additional permission error in reset password (#1187) - gillespi314: Revise help text on team members page (#1179) - zwass: Use global options as default for new teams (#1184) - zwass: Make naming of host columns consistent (#1183) - zwass: Fix authorization check in reset password (#1182) - martavis: Frontend of usage statistics (#1177) - zwass: Add environment to release action (#1222) - zwass: Prepare for v4.0.0-rc3 (#1223) - zwass: Add v4 suffix in go.mod (#1224) - zwass: Disable gomod proxy in goreleaser (#1225) - mike-j-thomas: Fleet email signature logo (#1229) - noahtalerman: Update documentation structure (#1230) - gillespi314: Add ability to rotate a user's API token (#1211) Read more: https://github.com/fleetdm/fleet/commits/master

I was pocking around for

orbit

documentations but i couldn’t find. keeping osquery updated started to be a pain, and i wanted to test

orbit

which is really promising. is there any doc that get me started? how can i make the source of binaries to be internal rpm repo? because not all machines will reach out to internet, so i would need to host orbit, and osquery packages internally and install orbit for the first time and keep it in sync with the internal repo for any new packages.

Hi Fleet team. We are seeing an http 500 error page in one of our 3.12 environments. The error is:

list hosts: Error 1054: Unknown column 'additional' in 'field list'

This started happening after we added the env variable to enable software inventory. However, reverting that change and restarting fleetd didn't resolve the issue. We had issues in several environments when upgrading from 3.9 to > 3.11 and I'm wondering if this env was somehow already broken and the service restart we just did finally tripped it. Would this error possibly be caused by an improper version upgrade - maybe the prepare db not being run?

Hello, I've updated to the last version. I've changed the old env variables (KOLIDE_ format) to new format. But when doing the migration it gives me this error:

2021/07/01 11:29:41 FAIL 20210601000001_CreateTeamsTables.go (alter hosts: Error 1005: Can't create table `fleet`.`hosts` (errno: 121 "Duplicate key on write or update")), quitting migration.

when I try and run fleet preview I get the following error : Failed to install: download archive https://github.com/fleetdm/fleet/releases/download/4.0.0/fleetctl_4.0.0_macos.tar.gz: Request failed with status code 404

Hey all, we are trying to integrate fleet/orbit into our existing MDR solution. Is there a way to send alerts from fleet? I didnt see anything in the documentation or config. Any help would be appreciated.

Hey all. I am trying to move some host from a demo-server to a non demo server. Is this possible? If yes, how do i go about it ? Any help would be appreciated.