🏗️ New commits pushed to Fleet »

Any rough guidance on server sizes for a fleet instance with around 1,500 hosts? Would be deployed to either on-premises or Azure

set the channel topic: Fleet 4.12.0 now available | fleetdm.com | github.com/fleetdm/fleet/releases/tag/fleet-v4.12.0

🏗️ New commits pushed to Fleet »

Hi there! I've run the deployment of a new version of fleet, everything went smoothly, however the tools is not allowing the login, in the logs I see

authentication error: find host: timestamp: 2022-03-29T17:04:30Z: missing destination name public_ip in *fleet.Host

I've remotely connected to the DB, but all the information is still there, any thoughts on this?

Is there a process to backup the queries i’ve added to my fleet?

Does anyone have a good search example for finding a specific Java version? (or rather: "higher than a certain version")? Ref. https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

Struggling a bit with the vulnerability scanning still, while troubleshooting I tried to download the CVE db and files and used the following command:

/fleet-cve $ fleetctl vulnerability-data-stream  --dir /fleet-cve/

I got the following result :

[-] Downloading CPE database...Error: rename /tmp/cpe.sqlite2494941906 /fleet-cve/cpe.sqlite: invalid cross-device link

when choosing a different path like /tmp it seems to work fine

/fleet-cve $ fleetctl vulnerability-data-stream  --dir /tmp

[-] Downloading CPE database... Done

[-] Downloading CVE data streams... Done

[+] Data streams successfully downloaded!

After that it was a simple mv from /tmp/<cvefiles> to /fleet-cve/ as the fleet user Trying to figure out if the invalid cross-device link is a Fleetdm issue or elsewhere. The /fleet-cve directory is mounted based on a kubernetes volumemount to a GCE persistent disk, and awful as it is , the dirs permissions are 777 Version 4.11.0 Any idea anyone ? Meanwhile waiting if the Home page results in a succesfull software capturing with the vulnerabilities ,( it says to wait an hour now 😉 )

This is probably a dumb question, but /var/lib/docker/volumes/fleetdm_data/_data appears to be full of cpe.sqlite\d{10} files that are 245M in size. a) what causes this to happen, and b) how should I keep these to a minimum?

Hi folks, I know this has been brought up several times before, but I'm surprised fleet is using the

hostname

from

system_info

as the UI element to display. People often work from home now, and so we have a bunch of hosts with a like

.<http://attlocal.net|attlocal.net>

or

.<http://myfiosgateway.com|myfiosgateway.com>

suffix on them and it just looks really disjoined. Would strongly prefer using

computer_name

or

local_hostname

here. Relevant issues: https://github.com/fleetdm/fleet/issues/4753 https://github.com/fleetdm/fleet/issues/4166

Hey folks! Have any of y'all tried to run Osquery+Fleet on your containers yet?

Hi - Has anyone written any queries for detecting recently logged in users? I'm asking because the "normal" way of detecting SSH keys w/o encryption kind of breaks with network-mounted homes (it tries and fails across 1000s of users)

hi, an issue reg. fleet running behind a load balancer

Hi team. When I perform a backup of my queries using

fleetctl get queries --yaml > query_backup_3_29_22.yml

when i read the yaml file it just says

please login with: fleetctl login

When I do I run fleetctl login I get the following

Login failed: POST /api/v1/fleet/login: do request: Post "https://<IP_ADDRESS>:8080/api/v1/fleet/login": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0

This was a good April Fools joke! https://twitter.com/fleetctl/status/1509988947665072129?t=s-tX4ldfM_qN-4kbe__YBA&amp;s=19

Fleet tests don’t work in ubuntu. My steps: git clone https://github.com/fleetdm/fleet cd fleet make deps make generate make docker-compose up -d make test-go I get this error:

go run ./tools/dbutils ./server/datastore/mysql/schema.sql
dumping schema to ./server/datastore/mysql/schema.sql
mkdir -p build/linux
mkdir -p build/darwin
go install <http://github.com/groob/mockimpl@latest|github.com/groob/mockimpl@latest>
go: finding module for package <http://golang.org/x/tools/imports|golang.org/x/tools/imports>
go: found <http://golang.org/x/tools/imports|golang.org/x/tools/imports> in <http://golang.org/x/tools|golang.org/x/tools> v0.1.10
go generate <http://github.com/fleetdm/fleet/v4/server/mock|github.com/fleetdm/fleet/v4/server/mock>
server/mock/datastore.go:9: running "mockimpl": exec: "mockimpl": executable file not found in $PATH
make: *** [Makefile:169: generate-mock] Error 1

go version 1.18 linux/amd64 npm -v 6.14.15 node -v 14.18.3 Note: on mac os (same steps) and the tests work without errors.

Hi there! hope u are doing great! I was trying to enable the software inventory option using the env variables below:

ENABLE_SOFTWARE_INVENTORY: true
FLEET_VULNERABILITIES_DATABASES_PATH: /home

hello fleet. can anyone remind me what #s fleet 3.13.0 was performances tested at?

🏗️ New commits pushed to Fleet »

Hello Fleet. We are running fleet 3.13 with a clustered redis (aws elasticache) of 3 nodes. We've noticed that when pointing Fleet to the cluster alias, all reads and writes end up on a single redis system (the cluster master) with the other 2 idle. Is there a way to split out reads and writes or general redis clustering support in 3.13 or newer versions?

Hi all, is there a flag to disable anonymous usage statistics? I only found this regarding disabling the feature: https://fleetdm.com/docs/using-fleet/usage-statistics#disable-usage-statistics which would force me to start the platform with statistics enabled to be able to disable it.

Fleet osquery has stopped in multiple windows machines, and even starting them from services doesn't work with windows error "Cannot find the file specified" . As I did some debug I found the orbit.exe is missing from the bin/orbit/windows/stable folder (empty folder) and in some cases bin/orbit/windows folder itself is missing. The symlink of orbit.exe is just pointing to some non-existent file. Any idea what could have happened?

🏗️ New commits pushed to Fleet »

Has anyone been able to make a label that will only have hosts from a specific vlan?

Hi all! I’m trying to follow @Benjamin Edwards article on setting up Fleet on AWS with Terraform. When I do “terraform init”, I get:

Error refreshing state: AccessDenied: Access Denied
	status code: 403, request id: 4739C470TC1FJYWN, host id: <snip>

This is my first time using terraform, so I am probably missing something… any suggestions?

I’m also trying to set up Fleet with Render with @Benjamin Edwards article. (Not trying to dunk on you, Mr. Edwards! I appreciate the articles!) When I try to start the web service, I get “NOPERM this user has no permissions to run the ‘cluster’ command or its subcommand” from redis. Apparently Render has restricted the “cluster” command. Is there any workaround?

Hi everyone 👋 I just upgraded from fleet

3.12.0

->

4.12.1

, did all the DB migrations and everything is working except in the UI when navigating to the queries page (/queries/manage) I get

500: Oh, something went wrong. Please file an issue if you believe this is a bug.

all the api hits to the server are 200's. I can do everything from the command line without error including

fleetctl get queries --yaml

so this appears to be a UI bug. I'm getting this chrome console error:

Syntax error found near Column Identifier (WHERE Clause)

Hi All, my name is Juan Fernandez, I just joined FleetDM as a Software Engineer, super excited to be part of this community 🙂

Hello Fleet. We have recently been experiencing some performance issues with our AWS elasticache redis instance. We are running fleet 3.13.3 with just shy of 40,000 nodes registered. Redis Engine CPU usage has been high for a while but then started to spike to 100% for ~4min, then drop down to 60% for ~3 min, then back up. This would cause the Fleet UI to behave very erratically. We traced the issue to our distributed interval which was set to 30 sec. Once we increased that to 120, redis engine CPU dropped to basically 0 (just under 1%). it seems clear that the 40,000 nodes checking in every 30 seconds was just too much to for redis to handle, though we scaled this to a very large instance when troubleshooting - cache.r6g.16xlarge. Couple of questions - it seems clear that the check ins that osquery clients do when pinging fleet to look for distributed queries to run definitely hit redis. What exactly is the check in doing and has this been tuned in more modern versions of fleet? Anyone out there with sizable osquery / Fleet installations have thoughts on what's a 'best practice' for the distributed interval setting? Do enterprise Fleet users generally never run distributed queries and instead take the time to always build packs, or are people just setting the interval in the couple min range and dealing with the delay to get results from ad-hoc UI queries? Thanks!